最初の3歩 1. Metabase Cloudに登録する2. データを接続する3. ダッシュボードを作成する
やめるときは導入した担当者に依頼
ライセンスの説明は要約です。法的助言ではありません。スターとは、GitHub の「いいね」に近い評価の数です。
安全性の表示は推定で、監査ではありません。ソフトは公開されている検査結果と脆弱性の報告、更新の止まり具合から判断しています。スキルは配布元の説明文からの推定で、配布物の中身（SKILL.md や同梱のプログラム）まではまだ検査できていません。「重大な問題は見つからず」は、問題が無いことの証明ではありません。軽い指摘が付いていることもあります。小さなプロジェクトや新しいスキルは低めに出ます。
| CVE ID | 重要度 | 状態 | 概要 |
|---|---|---|---|
| 番号なし | Critical | published | Multiple vulnerabilities across query validation, permissions, and network exposure |
| CVE-2026-72899 | Critical | published | SQL injection using a publicly shared dashboard leading to admin access |
| CVE-2026-72900 | Medium | published | Leaking sensitive data from the application database to low-privilege Metabase users |
| CVE-2026-72898 | Critical | published | SQL injection using an unauthenticated endpoint leading to admin access |
| 番号なし | Critical | published | Arbitrary File Read/Write via Unsafe H2 Built-in Functions |
| CVE-2026-59827 | Critical | published | Unsafe Deserialization of H2 Query Results |
| CVE-2026-59826 | Critical | published | Arbitrary Code Execution via Database Connection Detail Bypass |
| CVE-2026-50148 | Critical | published | Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write |
| CVE-2026-50147 | High | published | Arbitrary File Read via MySQL Connection Property Injection |
| 番号なし | Medium | published | Snippet Content Disclosure via Query Metadata Template Tags |
| 番号なし | Medium | published | Query Context Trusted from Client Bypasses Data Access Controls |
| 番号なし | Medium | published | Unauthenticated Entity ID to Internal ID Translation Endpoints |
| 番号なし | Medium | published | Public Dashboard Action Prefill Leaks Values for Unrelated Dashcards |
| 番号なし | Medium | published | Dashboard Update Response Leaks Card Details from Restricted Collections |
| CVE-2026-33725 | High | published | RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import |
| 番号なし | Medium | published | Unauthenticated access to dashboard parameter values when Public Sharing is disabled |
| CVE-2026-27464 | High | published | Authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. |
| CVE-2026-22805 | low | published | It's possible to use the channel test endpoint to reach internal local addresses |
| CVE-2025-32382 | low | published | Snowflake credentials logged by the Metabase backend |
| CVE-2025-30371 | low | published | It's possible to circumvent local link access protection in GeoJson endpoint |
| CVE-2025-27141 | Medium | published | Cached questions leak data to impersonated users |
| CVE-2024-55951 | Medium | published | Sandboxed users could see filter values from other sandboxed users |
| CVE-2023-37470 | Critical | published | Remote code execution via user-supplied H2 connection strings |
| CVE-2023-32680 | Medium | published | Native models enable people without SQL permissions to create and edit SQL snippets |
| CVE-2023-23628 | Medium | published | Dashboard subscription settings interface reveals list of recipients to sandboxed users |
| CVE-2023-23629 | Medium | published | Users can view data they don't have privileges to view by adding themselves to dashboard subscriptions created by users with more data privileges |
| CVE-2022-39358 | Critical | published | Possible to circumvent Locked parameter in Signed Embedding |
| CVE-2022-39360 | High | published | SSO users able to circumvent IdP login by doing password reset |
| CVE-2022-39359 | High | published | GeoJSON validation doesn't prevent redirects to blocked URLs |
| CVE-2022-39362 | High | published | Arbitrary SQL execution from queryhash |
| 公開された日 | 2015/02/02 |
| 最後に手が入った日 | 2026/02/25 |
| 当サイトが見つけた日 | 2026/02/24 |
| 日付 | スター数 | フォーク数 |
|---|---|---|
| 2026-02-24 | 46,093 | 6,244 |
| 2026-02-24 | 46,093 | 6,244 |
| 2026-02-25 | 46,099 | 6,244 |
| 2026-02-25 | 46,099 | 6,244 |
| 2026-02-25 | 46,100 | 6,245 |