CVE-2026-22805

Metabase channel test endpoint can reach internal local addresses

State: Published
Severity: 2.1 Low
Published: Jan 12, 2026
Updated: Jan 13, 2026
Reserved: Jan 9, 2026

Description

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
metabasemetabase	>= 0.57.0-beta, < 57.1Affected >= 0.56.0-beta, < 56.3Affected < 55.13Affected

References

https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.