CVE-2026-22805CWE-918

Metabase channel test endpoint can reach internal local addresses

Low · published January 12, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00240 · 14.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-01-12T22:36Z
EPSS history
Timeline
  • 12 JAN 22:36Z
    Metabase channel test endpoint can reach internal local addresses
    cvelistv5