Cyber Resilience

CVE-2026-22805

Low

Published: 12 January 2026

Published
12 January 2026
Modified
10 April 2026
KEV Added
—
Patch
—
CVSS Score v4 2.1 CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0020 9.9th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-22805 is a low-severity SSRF (CWE-918) vulnerability in Metabase Metabase. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-22805 is a vulnerability (CWE-918: Server-Side Request Forgery) affecting Metabase, an open-source data analytics platform. It impacts self-hosted Metabase instances prior to versions 55.13, 56.3, and 57.1 that allow users to create subscriptions, particularly when Metabase is colocated with other unsecured resources. The vulnerability was published on 2026-01-12 and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation enables high confidentiality impact via a changed scope, potentially allowing access to sensitive data in colocated unsecured resources through server-side requests initiated by subscription features.

The official Metabase security advisory (https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx) confirms the issue is fixed in Metabase versions 55.13, 56.3, and 57.1. Administrators of affected self-hosted instances should upgrade to these versions to mitigate the risk.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in…

more

55.13, 56.3, and 57.1.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SSRF in public-facing Metabase instance directly enables initial access via exploitation of a public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-27464Same product: Metabase Metabase
CVE-2026-33725Same product: Metabase Metabase
CVE-2024-13195Shared CWE-918
CVE-2026-5052Shared CWE-918
CVE-2025-58045Shared CWE-918
CVE-2025-69299Shared CWE-918
CVE-2026-42398Shared CWE-918
CVE-2026-7025Shared CWE-918
CVE-2025-2691Shared CWE-918
CVE-2025-21385Shared CWE-918

Affected Assets

metabase
metabase
0.57.0, 1.57.0 · ≤ 0.55.13 · ≤ 1.55.13 · 0.56.0 — 0.56.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the SSRF vulnerability by requiring timely patching of Metabase to fixed versions 55.13, 56.3, or 57.1.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes user inputs for subscription features to block malicious URLs that trigger server-side requests.

SC-7 Boundary Protection good match
preventdetect

Monitors and controls outbound communications at system boundaries to protect colocated unsecured resources from SSRF exploitation.

References