Metabase: Arbitrary file read/write via unsafe H2 built-in functions

Summary

Metabase releases from 1.55.0 up to the fixed builds pass native queries and actions against H2 data sources through without restricting built-in functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE and LINK_SCHEMA. A user who is allowed to run native queries or actions can use these functions to read or write arbitrary files on the Metabase server or to link other databases. The default sample database uses H2, so the vulnerable functionality is present in default installations. The CNA scores the issue 9.3 (CVSS 4.0, Critical), while the NVD record was still awaiting analysis at the time of review.

Affected

• Metabase 1.55.0 up to 1.58.16
• Metabase 1.59.0 up to 1.59.13
• Metabase 1.60.0 up to 1.60.9
• Metabase 1.61.0 up to 1.61.4
• Open-source (0.x) ranges as listed by the CNA: 0.55.0 up to 0.58.15.3, 0.59.0 up to 0.59.12.1, 0.60.0 up to 0.60.8.1, 0.61.0 up to 0.61.3.4

Fixed in

• 1.58.16
• 1.59.13
• 1.60.9
• 1.61.4
• Open-source tags v0.58.15.3, v0.59.12.1, v0.60.8.1 and v0.61.3.4 (the mapping between 1.x and 0.x numbering should be confirmed in the vendor release notes)

Workaround

Unknown. No vendor workaround specific to this CVE was found. Patching is the remediation.

Exploitation

• No evidence of exploitation in the wild for this CVE was found.
• No public proof-of-concept exploit was found for this CVE.
• CISA SSVC assessment: Exploitation none, automatable yes, technical impact total.
• Related Metabase CVEs (different issues) have been exploited or have public exploits, which indicates that attackers target Metabase.

Our recommendation

• Check the Metabase version of every instance now and identify self-hosted installations.
• Upgrade to the fixed build for your release branch as soon as possible; prioritise internet-reachable and multi-user instances.
• Review which users hold native query and action permissions, and remove them where they are not needed.
• Check whether H2 data sources, including the sample database, are connected and whether they can be reached by untrusted users.
• Monitor the server for unexpected file access or new database links.
• Confirm the fixed version in the vendor advisory before closing the change ticket.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-cwxq-fmxq-jv8h github.com
• OSV entry CVE-2026-103928 osv.dev
• Metabase commit 8fb4f0c (H2 function restrictions) github.com
• Metabase commit a943448 (H2 function restrictions) github.com
• Metabase release v0.58.15.3 github.com
• Metabase release v0.61.3.4 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:20.