CVE-2026-103928

{
  "etk_id": "ETK-2026-1480",
  "cve_id": "CVE-2026-103928",
  "display_id": "CVE-2026-103928",
  "ghsa_id": "GHSA-cwxq-fmxq-jv8h",
  "euvd_id": "EUVD-2026-98826",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file access through H2 native queries in Metabase",
  "summary": "Affected Metabase versions allow users authorized to run native queries or actions against an H2 data source to access files on the Metabase server or link other databases. The default sample database uses H2, so this exposure may be present without custom H2 configuration. Exploitation requires native-query or action permissions against an H2 data source.",
  "mitigation": "Upgrade Metabase to 1.58.16, 1.59.13, 1.60.9, 1.61.4, 0.58.15.3, 0.59.12.1, 0.60.8.1, or 0.61.3.4, as appropriate for your release line. Until upgraded, remove or restrict native-query and action access to H2 data sources, including the sample database.",
  "vendor": "metabase",
  "product": "metabase",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.55.0, < 1.58.16"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "1.58.16"
      ],
      "package_name": "metabase",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.59.0, < 1.59.13"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "1.59.13"
      ],
      "package_name": "metabase",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.60.0, < 1.60.9"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "1.60.9"
      ],
      "package_name": "metabase",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.61.0, < 1.61.4"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "1.61.4"
      ],
      "package_name": "metabase",
      "purl": null
    }
  ],
  "cwes": [
    73
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0041,
  "epss_percentile": 0.3354,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.31550045,
  "t0_at": "2026-10-13T15:44:37.906000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T15:44:37.906000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T15:44:37.906000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103928"
    }
  }
}