CVE-2026-92813
Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
CVSS 4.0 6.9 MEDIUMCVSS 3.1 4.9 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-92813
PublishedMetabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92813 · CVE overview and exploitation status
cve-program · CVE-2026-92813
- https://github.com/geo-chen/oss/blob/main/metabase.md#finding-2-geojson-ssrf-bypass-via-0000-address
- https://github.com/metabase/metabase/blob/v0.61.2/src/metabase/geojson/api.clj#L26-L47
- https://github.com/metabase/metabase
- https://www.vulncheck.com/advisories/metabase-through-0.63.18-ssrf-via-geojson-url-validation-bypass
Related changes
Linked by CVE identifierNo related changes are available here.