Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92813Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
Medium 4.9
In plain English
A medium-severity server-side request forgery in Metabase from metabase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.5%top 58.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- Researcher write-up, finding 2 technical-description, exploit
- the resolver rejects only link-local addresses technical-description
- https://github.com/metabase/metabase product
- VulnCheck Advisory: Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass third-party-advisory