CVE-2026-27464: 
NixOS vulnerability analysis and mitigation

CVE-2026-27464 is a server-side template injection (SSTI) vulnerability in Metabase, an open-source data analytics platform, that allows authenticated low-privileged users to extract sensitive information including database access credentials. It affects Metabase OSS and Enterprise versions prior to 0.57.13 and versions 0.58.0 through 0.58.6 (Enterprise: prior to 1.57.13 and 1.58.0–1.58.6). The vulnerability was published on February 21, 2026, with patches released on February 19–20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336) combined with improper control of code generation (CWE-94), classified under CAPEC-242 (Code Injection). The vulnerability resides in Metabase's notification system, where user-controlled input is passed into email body templates without adequate sanitization, allowing template expressions to be evaluated server-side. An authenticated user with low privileges can craft a malicious notification payload targeting the notifications endpoint, causing the template engine to evaluate expressions that expose sensitive server-side data such as database connection credentials. A technical write-up describing the exploitation path as leading to RCE via the notifications endpoint has been published (Infinit Security, GitHub Advisory).

Successful exploitation allows a low-privileged authenticated user to extract highly sensitive information from the Metabase instance, most critically database access credentials (usernames, passwords, connection strings) stored within the platform. This high confidentiality impact could enable an attacker to pivot directly to backend databases connected to Metabase, potentially exposing all data managed through the analytics platform. Integrity and availability are not directly impacted by this vulnerability, but credential theft could facilitate further lateral movement and broader compromise of connected data infrastructure (GitHub Advisory, Feedly).

As of the time of disclosure, there is no confirmed public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). However, a technical blog post describing the exploitation path — including potential for remote code execution via the notifications endpoint — has been published publicly (Infinit Security). The EPSS score is approximately 0.031% (0.000310), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Tenable Nessus plugin 299881 (Tenable).

1. Authentication: Log in to a target Metabase instance with any valid low-privileged user account.
2. Identify the notifications endpoint: Navigate to the Metabase notification or alert configuration functionality, which allows users to set up email-based alerts with customizable message bodies.
3. Craft a malicious template payload: Insert a template injection expression into the email body field of a notification. The payload should reference server-side objects or variables that expose sensitive configuration data (e.g., database connection settings).
4. Trigger notification delivery: Save and trigger the notification (e.g., by satisfying an alert condition or manually sending a test notification), causing the template engine to evaluate the injected expression server-side.
5. Retrieve exfiltrated credentials: The evaluated template output — containing database credentials or other sensitive configuration values — is delivered in the email body to the attacker-controlled recipient address (GitHub Advisory, Infinit Security).

• Logs: Metabase application logs showing unusual or repeated API calls to notification/alert configuration endpoints (e.g., /api/alert, /api/notification) by low-privileged user accounts; email delivery logs showing outbound notification emails to external or unexpected recipient addresses.
• Network: Outbound SMTP traffic triggered by low-privileged users at unusual times or frequencies; notification emails sent to addresses not associated with the Metabase user's registered email.
• Application Behavior: Notification templates containing unusual syntax such as {{, ${, #{, or other template expression delimiters in the email body field; alerts configured by non-admin users referencing system-level variables or configuration objects.

Metabase has released patched versions 0.57.13 (OSS) and 0.58.7 (OSS), and 1.57.13 and 1.58.7 (Enterprise), which fix this vulnerability. Users running any version prior to 0.57.13 or between 0.58.0–0.58.6 should upgrade immediately (Metabase v0.57.13 Release, Metabase v0.58.7 Release). As a temporary workaround for those unable to upgrade immediately, administrators should disable notifications in their Metabase instance to block access to the vulnerable endpoints (GitHub Advisory). After patching, organizations should rotate any database credentials that may have been accessible through the Metabase instance as a precautionary measure.

The Metabase security team (eliotmetabase) published the advisory on February 19, 2026, describing the issue as a critical security fix and urging immediate upgrades in the release notes for both v0.57.13 and v0.58.7 (Metabase v0.57.13 Release, Metabase v0.58.7 Release). A technical blog post from Infinit Security characterized the vulnerability as leading to potential RCE, elevating community concern beyond the credential-theft framing in the official advisory (Infinit Security). Coverage was picked up by aggregators including The Hacker Wire and Digg's cybersecurity section, and detection support was added by Tenable via Nessus plugin 299881 (Tenable).