CVE-2026-92813CWE-918ssrf

CVE-2026-92813

Medium · published September 17, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00474 · 40.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-17T01:17Z
References (4)
https://github.com/geo-chen/oss/blob/main/metabase.md#finding-2-geojson-ssrf-bypass-via-0000-address · [email protected]https://github.com/metabase/metabase · [email protected]https://github.com/metabase/metabase/blob/v0.61.2/src/metabase/geojson/api.clj#L26-L47 · [email protected]https://www.vulncheck.com/advisories/metabase-through-0.63.18-ssrf-via-geojson-url-validation-bypass · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
    cvelistv5