CVE-2026-22805

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22805", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.287Z", "datePublished": "2026-01-12T22:36:35.272Z", "dateUpdated": "2026-01-13T19:07:47.948Z"}, "containers": {"cna": {"title": "Metabase channel test endpoint can reach internal local addresses", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx"}], "affected": [{"vendor": "metabase", "product": "metabase", "versions": [{"version": ">= 0.57.0-beta, < 57.1", "status": "affected"}, {"version": ">= 0.56.0-beta, < 56.3", "status": "affected"}, {"version": "< 55.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T22:36:35.272Z"}, "descriptions": [{"lang": "en", "value": "Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1."}], "source": {"advisory": "GHSA-2wgg-7r2p-cmqx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:13:44.384619Z", "id": "CVE-2026-22805", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:07:47.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22805", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:13:44.384619Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:13:46.643Z"}}], "cna": {"title": "Metabase channel test endpoint can reach internal local addresses", "source": {"advisory": "GHSA-2wgg-7r2p-cmqx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "metabase", "product": "metabase", "versions": [{"status": "affected", "version": ">= 0.57.0-beta, < 57.1"}, {"status": "affected", "version": ">= 0.56.0-beta, < 56.3"}, {"status": "affected", "version": "< 55.13"}]}], "references": [{"url": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx", "name": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T22:36:35.272Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22805", "state": "PUBLISHED", "dateUpdated": "2026-01-13T19:07:47.948Z", "dateReserved": "2026-01-09T22:50:10.287Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T22:36:35.272Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "metabase", "vendor": "metabase", "versions": [{"status": "affected", "version": ">= 0.57.0-beta, < 57.1"}, {"status": "affected", "version": ">= 0.56.0-beta, < 56.3"}, {"status": "affected", "version": "< 55.13"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*", "matchCriteriaId": "F4A0D575-8CFF-4FFD-8139-C8AB9A2FBC08", "versionEndExcluding": "0.55.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "40AAAF84-1F5E-4A75-84BA-A42A95AE1930", "versionEndExcluding": "1.55.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*", "matchCriteriaId": "38B54579-0285-4B58-A30F-1ECCAA9C6F40", "versionEndExcluding": "0.56.3", "versionStartIncluding": "0.56.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "A939F298-EE96-4017-8322-192BA080F500", "versionEndExcluding": "1.56.3", "versionStartIncluding": "1.56.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:0.57.0:beta:*:*:-:*:*:*", "matchCriteriaId": "6205A3AA-7DDB-4450-9340-61EACE075F0C", "vulnerable": true}, {"criteria": "cpe:2.3:a:metabase:metabase:1.57.0:beta:*:*:enterprise:*:*:*", "matchCriteriaId": "F7765873-8C95-4AF8-A756-23C8AD7A1074", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1."}, {"lang": "es", "value": "Metabase es una plataforma de an\u00e1lisis de datos de c\u00f3digo abierto. Antes de 55.13, 56.3 y 57.1, las instancias de Metabase autoalojadas que permiten a los usuarios crear suscripciones podr\u00edan verse potencialmente afectadas si su Metabase est\u00e1 coubicada con otros recursos no seguros. Esta vulnerabilidad est\u00e1 corregida en 55.13, 56.3 y 57.1."}], "id": "CVE-2026-22805", "lastModified": "2026-06-17T10:20:27.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22805", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:13:44.384619Z", "version": "2.0.3"}}]}, "published": "2026-01-12T23:15:53.217", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:55:41.024538+00:00", "value": {"mitigation_remediation": ["Upgrade Metabase to version 55.13 or later (56.3 or 57.1 for newer series) to remove the channel test endpoint vulnerability.", "If upgrading immediately is not possible, restrict access to the /api/channel-test endpoint (e.g., require authentication or firewall rules).", "Implement network segmentation or outbound filtering to prevent Metabase from resolving or connecting to internal IP ranges, thereby limiting the impact of any SSRF attempts."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery enabling access to internal network addresses"}, "threat_synthesis": {"affected_systems": "Versions of Metabase older than 55.13, 56.3, and 57.1 are affected. Both the standard and enterprise editions include the vulnerable channel test endpoint. The flaw exists in the open\u2011source and beta releases of Metabase as well, as suggested by the affected\u2011CPE data. Updating to any release equal to or newer than 55.13 (for the 55 series), 56.3, or 57.1 removes the vulnerability.", "description_and_impact": "Metabase\u2019s channel test endpoint can be used by a client to issue requests to arbitrary internal host addresses. This Server\u2011Side Request Forgery flaw allows an attacker with access to the endpoint to read data from services that are otherwise isolated behind internal network boundaries, potentially exposing sensitive information. The weakness is classified as CWE-918, indicating improper validation of user\u2011controlled request data. The CVSS score of 2.1 reflects a low severity but the flaw still exposes internal resources to unauthenticated users if the endpoint is reachable.", "risk_and_exploitability": "The CVSS score of 2.1 indicates a low impact; however, the EPSS score of less than 1% suggests the risk of exploitation is very low at the time of this assessment. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to deliver a request to the channel test endpoint, which typically requires network connectivity to the Metabase instance. Because the flaw manifests only when the endpoint is exposed, the risk is further mitigated if the service is behind authentication or network restrictions."}}}}, "created": "2026-01-13T09:27:20.909649+00:00", "updated": "2026-04-18T07:00:11.351646+00:00", "vendors": ["metabase", "metabase$PRODUCT$metabase"]}