- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 40
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://www.metabase.com
Products and areas 12
- Alerts, subscriptions and scheduled reports, which run queries unattended and deliver results to an address a user chose
- Authentication end to end: password login, API keys, SSO through SAML, JWT and Google, and the account provisioning that follows a successful assertion
- Database connection handling for every shipped driver, including connection string parameters, credential storage, encryption at rest and the connection test endpoint
- Public links, embedding and the signed embedding tokens, which expose questions and dashboards to unauthenticated visitors by design
- Sandboxing and row-level restrictions, which are the boundary an operator relies on to let one team see a subset of another team's table
- The admin surface, including the audit tools and every setting an administrator can change on a running instance
- The full REST API, including the session, card, dashboard, collection, database and setup endpoints, plus CSRF and session cookie handling
- The native query editor and the query processor, covering how a user's SQL is built, parameterised and sent to the underlying engine
- The permission model in full: collection permissions, data permissions, native query privileges, group membership and every check that decides whether a user reaches a question, dashboard or database
- The policy asks for responsible disclosure of security information by email and draws no component boundary at all. Everything Metabase ships is inside it
- The setup and initialisation flow, along with any endpoint that remains reachable before an instance has been configured
- Uploads, model persistence, caching and the application database, wherever query results or user content are stored and read back
Out of scope (6)
- Database engines and JDBC drivers, unless Metabase's own use of the driver is what makes the defect reachable
- Filing on a public GitHub issue rather than by email, which the policy asks reporters not to do
- Instances deployed with no authentication in front of them or with the setup flow left incomplete, which is an operator decision
- Metabase Cloud's hosting infrastructure rather than the product code
- Permissions an administrator granted deliberately, including native query access to a database they chose to connect
- Third-party drivers and plugins outside the Metabase distribution
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
The policy asks you not to create a GitHub issue for a security bug, and that instruction is explicit
-
Name the Metabase version and the edition.
-
State the attacker's starting role and whether the instance requires authentication.
-
Say which database driver was connected.
-
Hold detail until the advisory and the release are out.
Not accepted
-
Permissions an administrator granted deliberately, including native query access to a database they chose to connect
-
Instances deployed with no authentication in front of them or with the setup flow left incomplete, which is an operator decision
-
Database engines and JDBC drivers, unless Metabase's own use of the driver is what makes the defect reachable
-
Third-party drivers and plugins outside the Metabase distribution
-
Metabase Cloud's hosting infrastructure rather than the product code
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-72898 | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. | Critical 10.0 | 10 Aug 2026 |
| CVE-2026-50147 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the | High 7.6 | 15 Jul 2026 |
| CVE-2026-50148 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC dri | Critical 10.0 | 15 Jul 2026 |
| CVE-2026-59826 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in vers | Critical 9.1 | 9 Jul 2026 |
| CVE-2026-59827 | Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execu | Critical 9.9 | 9 Jul 2026 |
| CVE-2026-33725 | Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` prop | High 7.2 | 27 Mar 2026 |
| CVE-2026-27464 | Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via templ | High 7.7 | 21 Feb 2026 |
| CVE-2026-22805 | Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1. | Low 2.1 | 12 Jan 2026 |
| CVE-2025-5895 | A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5c | Low 2.1 | 9 Jun 2025 |
| CVE-2025-27141 | Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see results of cached questions, even if their permissions don’t allow them to see the data. If some user runs a | Medium 4.8 | 24 Feb 2025 |
| CVE-2023-37470 | Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a connectio | Critical 10.0 | 4 Aug 2023 |
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2. | Critical 9.8 | 21 Jul 2023 |
| CVE-2023-32680 | Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query editing permissions to a database–but affected versions of Metabase didn't enforce that requirement. This lack of enforcement meant that: Anyone–including people in sandboxed groups–could edit SQL snippets. They could edit snippets via the A | Medium 5.8 | 18 May 2023 |
| CVE-2023-23628 | Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandbo | Medium 5.7 | 28 Jan 2023 |
| CVE-2023-23629 | Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receiv | Medium 6.3 | 28 Jan 2023 |
| CVE-2022-39362 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor sh | High 8.8 | 26 Oct 2022 |
| CVE-2022-39361 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL stateme | High 8.8 | 26 Oct 2022 |
| CVE-2022-39360 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password rese | Medium 6.5 | 26 Oct 2022 |
| CVE-2022-39359 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects | Medium 6.5 | 26 Oct 2022 |
| CVE-2022-39358 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6. | Medium 6.5 | 26 Oct 2022 |
| CVE-2022-43776 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects. | Medium 6.5 | 26 Oct 2022 |
| CVE-2022-24853 | Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attack | Medium 5.9 | 14 Apr 2022 |
| CVE-2022-24854 | Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do tha | High 8.0 | 14 Apr 2022 |
| CVE-2022-24855 | Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall t | High 8.7 | 14 Apr 2022 |
| CVE-2021-41277 | Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequen | Critical 10.0 | 17 Nov 2021 |
| CVE-2018-0697 | Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | Medium 6.1 | 15 Nov 2018 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 14 Last 12 months 40 Lifetime Access control 35 % SQL injection 25 % Info disclosure 25 % SSRF 15 % Latest advisories Loading the feed Overview Metabase is the self-hosted BI tool that small and mid-sized companies actually run, and every install holds standing credentials to the production databases an analyst was told to query. Fourteen advisories were published in the last twelve months out of forty ever, the heaviest sustained researcher workload of anything in this category. The maintainers state in their own policy that there is no bug bounty programme, and the check backs it up: no programme on any platform, live or historic. Reports go by email, the only private channel they run. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy asks for responsible disclosure of security information by email and draws no component boundary at all. Everything Metabase ships is inside it The permission model in full: collection permissions, data permissions, native query privileges, group membership and every check that decides whether a user reaches a question, dashboard or database The native query editor and the query processor, covering how a user's SQL is built, parameterised and sent to the underlying engine Database connection handling for every shipped driver, including connection string parameters, credential storage, encryption at rest and the connection test endpoint Sandboxing and row-level restrictions, which are the boundary an operator relies on to let one team see a subset of another team's table Public links, embedding and the signed embedding tokens, which expose questions and dashboards to unauthenticated visitors by design The full REST API, including the session, card, dashboard, collection, database and setup endpoints, plus CSRF and session cookie handling Authentication end to end: password login, API keys, SSO through SAML, JWT and Google, and the account provisioning that follows a successful assertion The setup and initialisation flow, along with any endpoint that remains reachable before an instance has been configured Uploads, model persistence, caching and the application database, wherever query results or user content are stored and read back Alerts, subscriptions and scheduled reports, which run queries unattended and deliver results to an address a user chose The admin surface, including the audit tools and every setting an administrator can change on a running instance Out of scope Metabase Cloud's hosting infrastructure rather than the product code Database engines and JDBC drivers, unless Metabase's own use of the driver is what makes the defect reachable Permissions an administrator granted deliberately, including native query access to a database they chose to connect Instances deployed with no authentication in front of them or with the setup flow left incomplete, which is an operator decision Third-party drivers and plugins outside the Metabase distribution Filing on a public GitHub issue rather than by email, which the policy asks reporters not to do Most-valued findings Permission bypass in any direction: a viewer reaching a collection they were excluded from, an analyst reaching a database outside their group, or a sandboxed user seeing rows the sandbox filtered. This is the densest part of a forty-advisory record SQL injection into a native query or a filter parameter, where a user-supplied value escapes parameterisation and runs against a production database with the connection's full rights Anything that returns stored database credentials, an encryption key or a connection secret to a user who should only ever see query results Authentication bypass in the SSO paths, especially identity binding, where an attacker-controlled assertion attaches to an existing account and takes over a BI tool with warehouse access Public link and embedding defects, where a signed token or a public question ID reaches data outside what was published. These are the only endpoints intended for unauthenticated visitors, so the checks behind them carry everything Server-side request forgery through connection setup or alert delivery, since the Metabase host usually sits inside the network the databases live on Endpoints reachable before or during setup, where an uninitialised instance grants administrative control to whoever arrives first Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] . That address appears only in the repository's SECURITY.md and is not on metabase.com/security at all GitHub private vulnerability reporting is disabled on metabase/metabase , so email is the sole private channel. There is no advisory button here The policy asks you not to create a GitHub issue for a security bug, and that instruction is explicit Nothing is paid. The policy states there is no bug bounty programme, and the vendor has never run one on any platform Name the Metabase version and the edition. Open source and the paid editions differ on permissions, sandboxing and SSO, and several of the interesting boundaries only exist in one of them State the attacker's starting role and whether the instance requires authentication. Metabase severity turns on whether a viewer, an analyst or an anonymous visitor reached the endpoint Say which database driver was connected. Most of the query-side surface only exists once a real data source is attached Disclosure Coordinated privately by email and published as a GitHub Security Advisory alongside a fixed release. The cadence here is heavy and regular: fourteen advisories in twelve months against forty all-time means the pipeline is moving constantly, and fixes tend to land in the next patch release across the supported version lines. Hold detail until the advisory and the release are out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability