Skip to content
Threat Feed
Subscribe

Vendor

Metabase

2 briefs RSS
critical advisory

Critical SQL Injection and Privilege Escalation Vulnerability in Metabase

An unauthenticated remote attacker can exploit a vulnerability in Metabase to perform SQL injection and escalate privileges.

PoC Metabase +2 sql-injection privilege-escalation web-application
2t 1c updated
high advisory

Metabase Enterprise Remote Code Execution via Serialization Import

Authenticated administrators in vulnerable Metabase Enterprise editions can achieve Remote Code Execution (RCE) and Arbitrary File Read by injecting an `INIT` property into the H2 JDBC spec via a crafted serialization archive through the `POST /api/ee/serialization/import` endpoint.

Metabase Enterprise metabase rce serialization cve-2026-33725
2r 1t