CVE-2022-39358: Metabase vulnerable to circumvention of Locked parameter in Signed Embedding

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-26 · updated 2026-06-17
Weakness: CWE-200

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

Affected products

metabase: from 0.42.0 before 0.42.6; from 0.43.0 before 0.43.7; from 0.44.0 before 0.44.5; from 1.42.0 before 1.42.6; from 1.43.0 before 1.43.7; from 1.44.0 before 1.44.5 — fixed in 0.42.6, 0.43.7, 0.44.5, 1.42.6, 1.43.7, 1.44.5

How to fix

Upgrade to a fixed version: metabase 0.42.6, 0.43.7, 0.44.5, 1.42.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-39358 or the next vulnerability affects your stack