CVE-2026-22805 Metabase channel test endpoint can reach internal local addresses
Attackers can exploit the channel test endpoint to access internal local addresses, potentially reading sensitive data from colocated unsecured resources.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22805?
CVE-2026-22805 is a low-severity server-side request forgery vulnerability in metabase, published on 12 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-22805?
It affects 1 product.
Products include Metabase Metabase.
How do I fix CVE-2026-22805?
No fix has been published for CVE-2026-22805 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-22805 being exploited?
There is no known exploitation of CVE-2026-22805 in the wild and no public exploit code.
Other vulnerabilities in metabase
- CVE-2026-72898 Metabase SQL Injection
- CVE-2021-41277 Metabase GeoJSON API Local File Inclusion
- CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2023-37470 Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
- CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results
Sources
Also known as GHSA-2wgg-7r2p-cmqx.