CVE-2026-27464: RCE in Metabase Data Analytics Platform

The primary impact of CVE-2026-27464 is the potential for unauthorized access to sensitive data stored within the Metabase instance's connected databases. An attacker, once authenticated, can leverage template evaluation to extract database credentials and other confidential information. This could lead to complete database compromise, enabling data exfiltration, modification, or deletion. The ability to retrieve database credentials directly represents a significant escalation of privilege, allowing attackers to move laterally within the network if the database has access to other systems. The blast radius extends to any data accessible through the compromised database, potentially impacting business-critical information and sensitive customer data.

1. Reserved2026-02-19
2. Published2026-02-21
3. Modified2026-02-24
4. EPSS updated2026-03-23

The definitive mitigation for CVE-2026-27464 is to upgrade Metabase to version 0.58.7 or later. If an immediate upgrade is not feasible, a temporary workaround involves disabling notifications within the Metabase instance. This prevents the vulnerable endpoint from being accessed, effectively blocking the attack vector. Monitor Metabase logs for any suspicious activity related to template evaluation or attempts to access database credentials. Consider implementing a Web Application Firewall (WAF) with rules to block requests containing potentially malicious template code. After upgrading, confirm the fix by attempting to trigger the vulnerable endpoint and verifying that it no longer returns sensitive data.