CVE-2026-50148

Name of the Vulnerable Software and Affected Versions Metabase versions 1.54.0 through 1.54.23 Metabase versions 1.55.x prior to 1.55.24 Metabase versions 1.56.x prior to 1.56.25 Metabase versions 1.57.x prior to 1.57.19 Metabase versions 1.58.x prior to 1.58.14 Metabase versions 1.59.x prior to 1.59.10 Metabase versions 1.60.x prior to 1.60.4

Description A user with permissions to add or edit database connections can achieve remote code execution on the server. This occurs when configuring a Snowflake connection to a server controlled by an attacker. A flaw in the Snowflake JDBC driver (Java Database Connectivity) allows the writing of arbitrary files anywhere on the host, which can be used to replace a database driver file that subsequently executes within the process.

Recommendations Update to version 1.54.24 Update to version 1.55.24 Update to version 1.56.25 Update to version 1.57.19 Update to version 1.58.14 Update to version 1.59.10 Update to version 1.60.4