CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
Unauthenticated attackers can bypass GeoJSON URL validation to access loopback services and read internal data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92813?
CVE-2026-92813 is a medium-severity server-side request forgery vulnerability in Metabase, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.
Weakness: CWE-918
Which versions are affected by CVE-2026-92813?
How do I fix CVE-2026-92813?
No fix has been published for CVE-2026-92813 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-92813 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92813 exists.
Sources
Also known as GHSA-vhcq-xc7j-xfj8.