CVE-2026-50147: Metabase Path Traversal Vulnerability

CVE-2026-50147 Overview

Metabase is an open-source business intelligence and embedded analytics platform used by organizations to visualize and analyze data. CVE-2026-50147 is an arbitrary file read vulnerability affecting Metabase versions from 1.57.0 up to the patched releases. An authenticated attacker with permission to configure database connections can supply unsafe Java Database Connectivity (JDBC) parameters when defining a MySQL or MariaDB connection. This causes the driver to read files from the Metabase host filesystem and return the contents through query results or validation error messages. The issue is tracked under CWE-88: Improper Neutralization of Argument Delimiters in a Command.

Critical Impact
Attackers with database configuration privileges can exfiltrate arbitrary files from the Metabase server, exposing credentials, configuration data, and sensitive application files.

Affected Products

Metabase versions 1.57.0 through 1.57.19 (fixed in 1.57.19.1)
Metabase versions 1.58.x prior to 1.58.14.1
Metabase versions 1.59.x prior to 1.59.10 and 1.60.x prior to 1.60.4

Discovery Timeline

2026-07-15 - CVE-2026-50147 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-50147

Vulnerability Analysis

The vulnerability resides in how Metabase constructs JDBC connection strings for MySQL and MariaDB database sources. Metabase accepts user-supplied JDBC parameters when an administrator configures a new database connection. The connector does not sufficiently sanitize these parameters before passing them to the underlying MySQL or MariaDB JDBC driver.

Both the MySQL Connector/J and MariaDB Connector/J drivers support parameters such as allowLoadLocalInfile and allowLoadLocalInfileInPath, which permit the driver to read local files as part of LOAD DATA LOCAL INFILE operations. When an attacker enables these parameters through injection into the connection string, the driver reads files from the Metabase host filesystem. The contents are then either returned in query results against the attacker-controlled database or surfaced in JDBC validation error messages when the connection is tested.

Root Cause

The root cause is improper neutralization of argument delimiters, cataloged as [CWE-88]. Metabase concatenates or forwards user-controlled parameters into the JDBC URL without an allowlist of safe options. This lets an attacker append or override JDBC parameters that alter driver behavior in security-relevant ways.

Attack Vector

Exploitation requires an account with permission to add or edit database connections in Metabase — typically an administrator or a delegated data source manager. The attacker configures a MySQL or MariaDB source pointing to an attacker-controlled server. By injecting parameters that enable local file reading, the attacker triggers the Metabase JVM process to open files such as /etc/passwd, application configuration files, or embedded credentials. The file contents are returned via the malicious database or leaked through connection validation errors displayed in the Metabase user interface.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-mfpj-crjq-xrcp for vendor details.

Detection Methods for CVE-2026-50147

Indicators of Compromise

Newly created or modified MySQL/MariaDB database connections in Metabase configured with unusual JDBC parameters such as allowLoadLocalInfile, allowLoadLocalInfileInPath, or autoDeserialize.
Outbound connections from the Metabase server to unfamiliar MySQL or MariaDB hosts on ports 3306 or non-standard ports.
Validation error messages in Metabase logs containing filesystem paths or file contents.

Detection Strategies

Audit the Metabase metabase_database table and admin activity logs for recently added or edited data sources, filtering on MySQL and MariaDB engine types.
Monitor the Metabase JVM process for reads of sensitive files such as /etc/passwd, /etc/shadow, and application configuration directories that are not part of normal operation.
Inspect Metabase application logs for JDBC connection strings containing dangerous parameter names.

Monitoring Recommendations

Enable verbose audit logging in Metabase and forward logs to a centralized SIEM for correlation.
Alert on any egress traffic from the Metabase host to external database endpoints not on an approved allowlist.
Track privilege changes for accounts with the database configuration entitlement.

How to Mitigate CVE-2026-50147

Immediate Actions Required

Upgrade Metabase to version 1.57.19.1, 1.58.14.1, 1.59.10, or 1.60.4 or later, matching your current release branch.
Review all existing MySQL and MariaDB database connections and remove any with suspicious JDBC parameters.
Rotate any credentials, API tokens, or secrets that may have been readable from the Metabase host filesystem.

Patch Information

Metabase has released fixed builds in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4. The patched versions restrict which JDBC parameters can be supplied through the database connection configuration interface. Refer to the Metabase Security Advisory GHSA-mfpj-crjq-xrcp for the complete list of fixed builds.

Workarounds

Restrict the database administration permission to a minimal set of trusted accounts until patching is complete.
Enforce network egress controls on the Metabase host to block outbound connections to untrusted MySQL/MariaDB endpoints.
Run Metabase under a low-privilege service account with filesystem access limited to directories required for operation.

bash

# Verify installed Metabase version and plan upgrade
curl -s http://<metabase-host>/api/session/properties | jq '.version'

# Example: run Metabase as a non-privileged user with restricted filesystem access
useradd --system --home /var/lib/metabase --shell /usr/sbin/nologin metabase
chown -R metabase:metabase /var/lib/metabase
sudo -u metabase java -jar metabase.jar