CVE-2026-50148 is a critical (CVSS 10.0) remote code execution flaw in Metabase from 1.54.0. A user who can add or edit a database connection can point a Snowflake connection at a server they control and write files on the Metabase host. Upgrade to 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10 or 1.60.4.
What's affected
- Product: Metabase, the open source business intelligence tool, on the 1.54 to 1.60 lines.
- Affected: 1.54.0 to before 1.54.24, 1.55 before 1.55.24, 1.56 before 1.56.25, 1.57 before 1.57.19, 1.58 before 1.58.14, 1.59 before 1.59.10 and 1.60 before 1.60.4.
- Fixed: 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10 and 1.60.4.
- Weakness: CWE-73, external control of file name or path.
- CVSS 10.0 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. - Published 15 July 2026. Not marked as exploited in CISA KEV.
The advisory says the attacker needs permission to add or edit a database connection, which is typically an administrator. The vector shows no privileges, so the record's score is higher than the practical risk in a tightly run instance.
How to check if you're exposed
Find your Metabase version. In the web app, the About Metabase item in the help menu shows it. For container deployments, check the image tag.
docker ps --format '{.Image}' | grep -i metabase
java -jar metabase.jar version 2>/dev/null
Then answer two questions. Which users and groups can add or edit database connections? Do you use Snowflake as a data source? The advisory is about a Snowflake connection pointed at an attacker-controlled server, so a tight list of editors is a real mitigation while you upgrade.
What to do now
- Upgrade to the fixed release for your line, for example 1.60.4 if you are on 1.60.
- Reduce the list of people who can add or edit database connections to the smallest group possible.
- Audit existing Snowflake connections and confirm each one points at a Snowflake account you own.
- Run Metabase as a low privilege user, with a read-only application directory where you can, so a file write has less to replace.
- Check the host for unexpected changes to Metabase driver files and for new files in its install directory.
Why it matters
The weakness sits in a database driver, not in Metabase logic. The advisory says a flaw in the Snowflake JDBC driver lets a server controlled by the attacker write files anywhere on the Metabase host, including one of Metabase's own driver files. The next time Metabase loads that file, the attacker's code runs inside the Metabase process. The record classifies the issue under CWE-73.
It is a good example of how a trusted connection setting can turn into code execution. Treat the right to configure data sources as a high privilege, and treat third party drivers as part of your attack surface.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this only a risk from administrators?
The advisory says the permission to add or edit connections is needed, which is usually an admin right. Review who holds it.
Sources
Last reviewed: 19 October 2026.
