CVE-2026-50148 Overview
Metabase is an open-source business intelligence and embedded analytics platform. CVE-2026-50148 allows authenticated users with database connection privileges to achieve remote code execution on the Metabase server. The flaw resides in how the Snowflake Java Database Connectivity (JDBC) driver processes responses from a Snowflake server. An attacker configures a Snowflake connection pointing to an attacker-controlled server, which then writes arbitrary files to the Metabase host. By overwriting one of Metabase's own database driver files, the attacker gains code execution inside the Metabase process on the next load.
Critical Impact
Any user permitted to add or edit a database connection can execute arbitrary code on the Metabase host with the privileges of the Metabase process.
Affected Products
- Metabase versions 1.54.0 through 1.54.23
- Metabase 1.55.x prior to 1.55.24, 1.56.x prior to 1.56.25, 1.57.x prior to 1.57.19
- Metabase 1.58.x prior to 1.58.14, 1.59.x prior to 1.59.10, and 1.60.x prior to 1.60.4
Discovery Timeline
- 2026-07-15 - CVE-2026-50148 published to the National Vulnerability Database (NVD)
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-50148
Vulnerability Analysis
The vulnerability is classified as [CWE-73]: External Control of File Name or Path, resulting in remote code execution. Metabase relies on the Snowflake JDBC driver to communicate with Snowflake data warehouses. When establishing a connection, the driver trusts responses from the configured Snowflake endpoint and writes files to disk based on server-supplied paths. An attacker who controls the endpoint can direct the driver to write arbitrary content to arbitrary locations on the Metabase server filesystem.
Because Metabase loads database driver files dynamically from disk, an attacker can overwrite an existing driver JAR file. The next time Metabase loads that driver, the attacker-supplied Java bytecode executes within the Metabase Java Virtual Machine (JVM) process.
Root Cause
The root cause is external control of file paths inside the Snowflake JDBC driver combined with Metabase's use of writable driver directories. The driver does not restrict destination paths to a sandboxed download directory, and Metabase does not verify driver file integrity before class loading.
Attack Vector
Exploitation requires an authenticated Metabase account with permission to create or edit database connections. The attacker adds a Snowflake data source referencing a hostname they control. When Metabase initiates the connection, the malicious Snowflake server responds with crafted payloads that instruct the JDBC driver to write a malicious JAR to Metabase's driver plugin directory, replacing a legitimate driver. Subsequent driver loading triggers arbitrary code execution as the Metabase service user.
Refer to the GitHub Security Advisory GHSA-r6x2-rchx-q9g9 for advisory details.
Detection Methods for CVE-2026-50148
Indicators of Compromise
- Unexpected modifications, creations, or timestamp changes on files within the Metabase plugins/ directory or driver JAR paths.
- New or edited Snowflake database connections referencing hostnames outside the organization's known Snowflake accounts.
- Outbound network connections from the Metabase host to unrecognized hosts on Snowflake JDBC ports (typically TCP 443).
- Metabase process spawning unexpected child processes such as shells, curl, or wget.
Detection Strategies
- Audit Metabase application logs for database connection creation and edit events, correlating the actor account and target hostname.
- Monitor file integrity on the Metabase driver directory using host-based file integrity monitoring (FIM) tools.
- Alert on JVM process behavior anomalies, including unexpected class loading paths or process forks from the Metabase service.
Monitoring Recommendations
- Enable verbose audit logging in Metabase and forward events to a centralized logging platform for retention and correlation.
- Baseline outbound connections from the Metabase host and alert on new destinations, particularly those not part of approved Snowflake tenants.
- Track admin and connection-management role assignments so that permission grants that could enable this attack are reviewed.
How to Mitigate CVE-2026-50148
Immediate Actions Required
- Upgrade Metabase to a fixed release version without delay.
- Review all existing Snowflake database connections and remove any that reference untrusted or unknown hostnames.
- Audit the list of users granted permission to add or edit database connections and revoke access where it is not required.
- Inspect the Metabase driver plugin directory for unexpected or recently modified JAR files and restore known-good binaries.
Patch Information
Metabase has released fixed builds in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4. Administrators should apply the patch corresponding to their release branch. See the Metabase Security Advisory for release notes and upgrade instructions.
Workarounds
- Restrict database connection management permissions to a minimal set of trusted administrators until patches are applied.
- Use network egress controls to allow the Metabase host to reach only approved Snowflake account hostnames.
- Apply filesystem permissions that prevent the Metabase process from overwriting driver files at runtime where feasible.
- Monitor the driver directory with file integrity monitoring and alert on any modification.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
