Nixpkgs security tracker

Untriaged

Permalink CVE-2026-72899

10.0 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): High (H)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 2 weeks, 5 days ago Activity log

Created suggestion 2 weeks, 5 days ago

Metabase SQL injection via public card or dashboard

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

References

url vendor-advisory
url vdb-entry
url third-party-advisory

Affected products

Metabase

<x.58.24
==x.61.11
==x.59.21
==x.58.24
<x.60.17
<x.62.9
<x.59.21
<x.61.11
==x.63.5
<x.63.5
==x.62.9
==x.60.17

Matching in nixpkgs

pkgs.metabase

Business Intelligence and Embedded Analytics tool

nixos-unstable 0.59.2
- nixpkgs-unstable 0.59.2
- nixos-unstable-small 0.59.2
nixos-26.05 0.59.2
- nixos-26.05-small 0.59.2
- nixpkgs-26.05-darwin 0.59.2

Package maintainers

@thoughtpolice Austin Seipp <aseipp@pobox.com>
@mmahut Marek Mahut <marek.mahut@gmail.com>

Untriaged

Permalink CVE-2026-72900

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 2 weeks, 5 days ago Activity log

Created suggestion 2 weeks, 5 days ago

Metabase information exposure

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

References

url vendor-advisory
url vdb-entry
url third-party-advisory

Affected products

Metabase

<x.58.24
==x.61.11
==x.59.21
==x.58.24
<x.60.17
<x.62.9
<x.59.21
<x.61.11
==x.63.5
<x.63.5
==x.62.9
==x.60.17

Matching in nixpkgs

pkgs.metabase

Business Intelligence and Embedded Analytics tool

nixos-unstable 0.59.2
- nixpkgs-unstable 0.59.2
- nixos-unstable-small 0.59.2
nixos-26.05 0.59.2
- nixos-26.05-small 0.59.2
- nixpkgs-26.05-darwin 0.59.2

Package maintainers

@thoughtpolice Austin Seipp <aseipp@pobox.com>
@mmahut Marek Mahut <marek.mahut@gmail.com>

Untriaged

Permalink CVE-2026-72898

10.0 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): High (H)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 2 weeks, 5 days ago Activity log

Created suggestion 2 weeks, 5 days ago

Metabase SQL injection via password reset endpoint

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

References

url vendor-advisory
url vendor-advisory
url vdb-entry
url third-party-advisory

Affected products

Metabase

<x.58.24
==x.61.11
==x.59.21
==x.58.24
<x.60.17
<x.62.9
<x.59.21
<x.61.11
==x.63.5
<x.63.5
==x.62.9
==x.60.17

Matching in nixpkgs

pkgs.metabase

Business Intelligence and Embedded Analytics tool

nixos-unstable 0.59.2
- nixpkgs-unstable 0.59.2
- nixos-unstable-small 0.59.2
nixos-26.05 0.59.2
- nixos-26.05-small 0.59.2
- nixpkgs-26.05-darwin 0.59.2

Package maintainers

@thoughtpolice Austin Seipp <aseipp@pobox.com>
@mmahut Marek Mahut <marek.mahut@gmail.com>

Untriaged

Permalink CVE-2026-50148

10.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.

References

https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9 x_refsource_CONFIRM

Affected products

metabase

==>= 1.56.0, < 1.56.25
==>= 1.59.0, < 1.59.10
==>= 1.58.0, < 1.58.14
==>= 1.57.0, < 1.57.19
==>= 1.54.0, < 1.54.24
==>= 1.60.0, < 1.60.4
==>= 1.55.0, < 1.55.24

Matching in nixpkgs

pkgs.metabase

Business Intelligence and Embedded Analytics tool

nixos-unstable -
- nixos-unstable-small 0.59.2
nixos-26.05 -
- nixos-26.05-small 0.59.2

Package maintainers

@mmahut Marek Mahut <marek.mahut@gmail.com>
@thoughtpolice Austin Seipp <aseipp@pobox.com>

Untriaged

Permalink CVE-2026-59827

9.9 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

Metabase: Unsafe Deserialization of H2 Query Results

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.

References

https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36 x_refsource_CONFIRM
https://github.com/metabase/metabase/commit/00f42511fe3bc4385652a2e96862ee6fd7d42cf8 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.58.15 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.59.12 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.60.6.3 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.61.1.4 x_refsource_MISC

Affected products

metabase

==>= 1.61.0, < 1.61.1.4
==>= 1.59.0, < 1.59.12
==>= 1.60.0, < 1.60.6.3
==>= 1.58.0, < 1.58.15

Matching in nixpkgs

pkgs.metabase

Business Intelligence and Embedded Analytics tool

nixos-unstable -
- nixos-unstable-small 0.59.2
nixos-26.05 -
- nixos-26.05-small 0.59.2

Package maintainers

@mmahut Marek Mahut <marek.mahut@gmail.com>
@thoughtpolice Austin Seipp <aseipp@pobox.com>

Untriaged

Permalink CVE-2026-59826

9.1 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.

References

https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35 x_refsource_CONFIRM
https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.58.15.1 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.59.12 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.60.6.3 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.61.2 x_refsource_MISC

Affected products

metabase

==>= 1.59.0, < 1.59.12
==>= 1.60.0, < 1.60.6.3
==>= 1.55.0, < 1.58.15.1
==>= 1.61.0, < 1.61.2

Matching in nixpkgs

pkgs.metabase

Business Intelligence and Embedded Analytics tool

nixos-unstable -
- nixos-unstable-small 0.59.2
nixos-26.05 -
- nixos-26.05-small 0.59.2

Package maintainers

@mmahut Marek Mahut <marek.mahut@gmail.com>
@thoughtpolice Austin Seipp <aseipp@pobox.com>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.metabase

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.metabase

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.metabase

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.metabase

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.metabase

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.metabase

Package maintainers