ZeusQA
Start free

Known exploited vulnerabilities

Metabase vulnerabilities attackers have used

Every Metabase vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 2 Metabase vulnerabilities as exploited in the wild, 1 of them added in the last 12 months. The most recent is CVE-2026-72898, added Aug 11, 2026. Metabase has the most entries (2).

In KEV, all time
2
Added, last 12 months
1
Used in ransomware
0
New CVEs this week
0

Every Metabase entry in CISA KEV

  1. CVE-2026-72898

    Added · due

    Metabase SQL Injection Vulnerability

    Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the…

  2. CVE-2021-41277

    Added · due

    Metabase GeoJSON API Local File Inclusion Vulnerability

    Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works