CVE-2026-50148

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

State: Published
Severity: 10.0 Critical
Published: Jul 15, 2026
Updated: Jul 20, 2026
Reserved: Jun 3, 2026

Description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-73 External Control of File Name or Path

Affected Products

Product	Versions
metabasemetabase	>= 1.54.0, < 1.54.24Affected >= 1.55.0, < 1.55.24Affected >= 1.56.0, < 1.56.25Affected >= 1.57.0, < 1.57.19Affected >= 1.58.0, < 1.58.14Affected >= 1.59.0, < 1.59.10Affected >= 1.60.0, < 1.60.4Affected

References

https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.