medium4.9
CVE-2026-92813
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopbac…
Impact
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.
Affected products
| Product | Affected versions |
|---|---|
| Metabase | through 0.63.18 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/geo-chen/oss/blob/main/metabase.md#finding-2-geojson-ssrf-bypass-via-0000-address
- https://github.com/metabase/metabase
- https://github.com/metabase/metabase/blob/v0.61.2/src/metabase/geojson/api.clj#L26-L47
- https://www.vulncheck.com/advisories/metabase-through-0.63.18-ssrf-via-geojson-url-validation-bypass