CVE-2026-103928

Name of the Vulnerable Software and Affected Versions Metabase versions 1.55.0 through 1.58.15 Metabase versions 1.59.0 through 1.59.12 Metabase versions 1.60.0 through 1.60.8 Metabase versions 1.61.0 through 1.61.3

Description Native queries and actions against an H2 data source are processed without restricting host-facing built-in functions. An authorized user can invoke functions such as FILE READ(), FILE WRITE(), CSVREAD(), CSVWRITE(), or LINK SCHEMA() to read or write arbitrary files on the server or link other databases. This issue is present by default as the sample database utilizes H2.

Recommendations Update to version 1.58.16 Update to version 1.59.13 Update to version 1.60.9 Update to version 1.61.4