CVE-2026-92813 Overview
CVE-2026-92813 is a Server-Side Request Forgery (SSRF) vulnerability in Metabase through version 0.63.18. The flaw resides in the custom GeoJSON URL handling logic, which fails to properly validate the unspecified IPv4 address 0.0.0.0. Attackers can save a malicious GeoJSON entry pointing at 0.0.0.0 and trigger server-side requests that return responses from loopback services to unauthenticated callers. The weakness is classified under CWE-918: Server-Side Request Forgery and enables interaction with services that are only reachable from the Metabase host itself.
Critical Impact
Unauthenticated attackers can reach loopback-bound internal services through the Metabase GeoJSON proxy, exposing data from services that assume they are unreachable externally.
Affected Products
- Metabase versions through 0.63.18
- Metabase GeoJSON API endpoint (/api/geojson)
- Deployments exposing Metabase to untrusted networks
Discovery Timeline
- 2026-09-16 - CVE-2026-92813 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-92813
Vulnerability Analysis
Metabase supports custom map layers backed by user-supplied GeoJSON URLs. The server fetches these URLs on behalf of the client and returns the parsed content. To prevent SSRF, Metabase applies URL validation intended to block loopback and private-range destinations before the fetch is issued.
The validation logic in the GeoJSON API implementation does not treat 0.0.0.0 as equivalent to the loopback interface. On many operating systems, connecting to 0.0.0.0 resolves to services bound to any local interface, including 127.0.0.1. An attacker who can save a GeoJSON layer with a 0.0.0.0 URL causes Metabase to issue requests to internal services and return their responses. Because the retrieval endpoint responds to unauthenticated callers, the attack does not require valid session credentials once a malicious entry is stored.
Root Cause
The root cause is an incomplete deny-list in the URL validator within the metabase.geojson.api namespace. See the Metabase GeoJSON API source. The check inspects the target host string but does not normalize 0.0.0.0 to its effective loopback destination, allowing the address through the guard.
Attack Vector
The attack is network-based and requires an administrator-controlled path to persist a custom GeoJSON entry pointing at http://0.0.0.0:<port>/<path>. Once stored, retrieval of that entry can be triggered by unauthenticated callers through the public GeoJSON endpoint. The server-side fetch reaches services bound to the loopback interface, including internal APIs, metadata endpoints, and administrative daemons. Response bodies are proxied back to the unauthenticated caller. Full technical details are documented in the GeoJSON SSRF Bypass write-up and the VulnCheck SSRF Advisory for Metabase.
Detection Methods for CVE-2026-92813
Indicators of Compromise
- Requests to /api/geojson referencing custom map identifiers followed by outbound server-side connections to 0.0.0.0 or 127.0.0.1.
- Custom GeoJSON entries saved with URLs containing 0.0.0.0, 0.0.0.0:<port>, or hex/octal encodings of the unspecified address.
- Unusual loopback traffic originating from the Metabase JVM process to internal ports such as metadata services or admin consoles.
Detection Strategies
- Audit the Metabase settings table for custom-geojson entries and flag any URL whose host resolves to 0.0.0.0, loopback, link-local, or private ranges.
- Correlate access logs on /api/geojson/:key with process-level network telemetry to identify server-initiated fetches to internal addresses.
- Deploy egress filtering alerts for the Metabase host that fire when the application connects to loopback ports it does not normally use.
Monitoring Recommendations
- Enable verbose HTTP client logging on the Metabase application server and forward it to a centralized log platform.
- Monitor administrative API activity for creation or modification of custom GeoJSON entries, particularly from unfamiliar accounts.
- Track response sizes and content types returned from /api/geojson to detect proxied content from non-GeoJSON internal services.
How to Mitigate CVE-2026-92813
Immediate Actions Required
- Restrict administrative access to the Metabase instance and require multi-factor authentication for any account able to save custom GeoJSON entries.
- Review and delete any existing custom GeoJSON records that reference 0.0.0.0, loopback, link-local, or internal RFC 1918 addresses.
- Place Metabase behind an egress proxy that denies outbound connections from the application to 0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, and internal management networks.
Patch Information
At the time of publication, the Metabase repository is the authoritative source for fixed release information. Administrators should upgrade to a Metabase release later than 0.63.18 that documents remediation for this SSRF and consult the VulnCheck advisory for confirmed fixed versions.
Workarounds
- Disable the custom GeoJSON feature through Metabase administrative settings if custom map layers are not required.
- Enforce host-based firewall rules on the Metabase server that block outbound traffic from the JVM process to loopback and internal management endpoints.
- Terminate Metabase behind a reverse proxy that strips or rewrites requests to /api/geojson/:key for unauthenticated callers until an official patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
