Vulnerability · Published Jan 12, 2026 · Assigned by GitHub_M

CVE-2026-22805Metabase channel test endpoint can reach internal local addresses

Low 2.1

In plain English

A low-severity server-side request forgery in metabase from metabase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.

Affected products (as reported)

Vendor	Product	Versions
metabase	metabase	>= 0.57.0-beta, < 57.1>= 0.56.0-beta, < 56.3< 55.13

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx x_refsource_CONFIRM