Brand
Metabase: actively exploited vulnerabilities
2 vulnerabilities in Metabase products (Metabase) are in CISA’s catalog of exploited vulnerabilities, 1 of them added in the last 90 days. Last added: August 11, 2026.
-
1 vulnerability added in the last 12 months
-
2 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one Metabase category to your radar, or open its page.
- ERP, business applications and databases 2 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
- Metabase2 vulnerabilities, Business apps and data
Name used by CISA: Metabase. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Metabase list.
- Rank 1
MetabaseCVE-2026-72898
Metabase SQL Injection Vulnerability
Active CERT-FR alertHunt for compromise (CISA)
CVSS severity 10.0critical
Added Aug 11, 2026
- Rank 2
MetabaseCVE-2021-41277
Metabase GeoJSON API Local File Inclusion Vulnerability
CVE from 2021, added in 2024
CVSS severity 7.5high
Added Nov 12, 2024
Follow and verify
Indicative classification, based on the vendor and product names given by CISA. How products are classified.