What’s Vulnerable › Vulnerabilities
CVE-2026-22805: Metabase channel test endpoint can reach internal local addresses
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-12 · updated 2026-06-17
- Weakness: CWE-918
Description
Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.
Affected products
- metabase: before 0.55.13; before 1.55.13; from 0.56.0 before 0.56.3; from 1.56.0 before 1.56.3; 0.57.0-beta, 1.57.0-beta — fixed in 0.55.13, 0.56.3, 1.55.13, 1.56.3
How to fix
Upgrade to a fixed version: metabase 0.55.13, 0.56.3, 1.55.13, 1.56.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-22805 or the next vulnerability affects your stack