CVE-2026-27464
📋 TL;DR
This vulnerability allows authenticated users in Metabase to extract sensitive information including database credentials via template evaluation in email notifications. It affects Metabase instances running versions prior to 0.57.13 or versions 0.58.x through 0.58.6. Any organization using these vulnerable versions with authenticated users is at risk.
💻 Affected Systems
- Metabase
📦 What is this software?
Metabase by Metabase
Metabase by Metabase
Metabase by Metabase
Metabase by Metabase
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain database credentials leading to full database compromise, data exfiltration, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to sensitive configuration data and database credentials, enabling data theft and potential privilege escalation.
If Mitigated
Limited impact with proper access controls, but still exposes sensitive configuration information to authenticated users.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.57.13 or 0.58.7
Vendor Advisory: https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9
Restart Required: Yes
Instructions:
1. Backup your Metabase instance and database. 2. Download and install Metabase version 0.57.13 or 0.58.7 from official releases. 3. Restart the Metabase service. 4. Verify the version is updated.
🔧 Temporary Workarounds
Disable Notifications
allDisable all email notifications to block access to vulnerable template evaluation endpoints
Navigate to Admin > Settings > Email in Metabase UI and disable email notifications
🧯 If You Can't Patch
- Implement strict access controls and limit authenticated user permissions
- Monitor for suspicious access patterns to notification endpoints and credential extraction attempts
🔍 How to Verify
Check if Vulnerable:
Check Metabase version via Admin panel or by examining the application metadataCheck Version:
Check Admin > Troubleshooting > About in Metabase UI or examine application startup logsVerify Fix Applied:
Confirm version is 0.57.13 or higher, or 0.58.7 or higher, and test that authenticated users cannot extract credentials via notifications📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to notification endpoints
- Multiple failed or successful attempts to access template evaluation features
Network Indicators:
- Increased traffic to notification-related API endpoints from authenticated users
SIEM Query:
source="metabase" AND (uri_path="/api/notification" OR uri_path="/api/email") AND user_authenticated=true