CVE-2026-50147: 
NixOS vulnerability analysis and mitigation

CVE-2026-50147 is an arbitrary file read vulnerability in Metabase, an open-source business intelligence and embedded analytics platform, caused by improper neutralization of argument delimiters in MySQL/MariaDB JDBC connection parameters (CWE-88). An attacker with the ability to configure a Metabase database connection can inject unsafe JDBC parameters into a MySQL or MariaDB connection string, causing the server to read arbitrary files from its own filesystem and expose their contents. Affected versions span 1.57.0 through 1.57.19.1, 1.58.0 through 1.58.14.1, 1.59.0 through 1.59.10, and 1.60.0 through 1.60.4. The vulnerability was published on July 15, 2026, with a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory).

The root cause is improper neutralization of argument delimiters in JDBC connection parameters (CWE-88): Metabase does not sufficiently validate or sanitize parameters supplied when configuring a MySQL or MariaDB database connection, allowing an attacker to inject unsafe JDBC connection properties. When Metabase establishes the connection, the MySQL/MariaDB JDBC driver processes these injected parameters — including options such as allowLoadLocalInfile or allowUrlInLocalInfile — which instruct the driver to read files from the Metabase host's local filesystem. The file contents are then returned to the attacker either through query results against the connected database or through error messages generated during connection validation. Exploitation requires High privileges (administrator-level access to Metabase's database connection configuration) and network reachability to a MySQL or MariaDB server, which the attacker already controls (GitHub Advisory).

Successful exploitation allows a privileged attacker to read arbitrary files from the Metabase server's filesystem, including highly sensitive assets such as the Metabase application database, environment variable files (which may contain API keys, secrets, or credentials), and OS configuration files. The confidentiality impact is rated High, with a low integrity impact (e.g., potential for data manipulation via injected parameters) and no direct availability impact. While exploitation requires administrator-level access, the scope change (S:C) in the CVSS score reflects that the impact extends beyond the Metabase application itself to the underlying host system, potentially enabling credential harvesting and lateral movement within the broader infrastructure (GitHub Advisory).

As of the publication date, there is no evidence of in-the-wild exploitation, and no public proof-of-concept exploit code has been identified. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for high-privilege (administrator) access to Metabase's database connection settings. The EPSS score is approximately 0.002 (0.2%), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Gain Administrator Access: Obtain Metabase administrator credentials through phishing, credential stuffing, or insider access — required to configure database connections.
2. Create or Edit a MySQL/MariaDB Connection: Navigate to the Metabase admin panel and create a new MySQL or MariaDB database connection, or edit an existing one.
3. Inject Unsafe JDBC Parameters: Append unsafe JDBC connection parameters to the connection string (e.g., allowLoadLocalInfile=true&allowUrlInLocalInfile=true) targeting a MySQL/MariaDB server under the attacker's control.
4. Trigger Connection: Save and validate the connection, causing Metabase to open the JDBC connection with the injected parameters. The MySQL JDBC driver will attempt to read local files from the Metabase host.
5. Exfiltrate File Contents: Issue queries against the connected database (e.g., LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE ...) or inspect connection validation error messages to retrieve the contents of targeted files such as /etc/passwd, .env, or the Metabase application database.
6. Leverage Extracted Data: Use harvested credentials, secrets, or configuration data for further lateral movement or privilege escalation within the environment (GitHub Advisory).

• Logs: Metabase application logs showing creation or modification of MySQL/MariaDB database connections by administrator accounts, especially with unusual or lengthy connection string parameters; connection validation errors referencing local file paths.
• Network: Outbound connections from the Metabase server to an external or unexpected MySQL/MariaDB server (port 3306) not previously observed in baseline traffic.
• File System: Evidence of file access to sensitive paths (e.g., /etc/passwd, /etc/environment, .env, Metabase's metabase.db/) correlating with JDBC connection activity in application logs.
• Database: Presence of LOAD DATA LOCAL INFILE statements in MySQL general query logs on the attacker-controlled server, containing contents of files from the Metabase host.

Metabase has released patched versions that address this vulnerability: 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4 (and their corresponding 0.x open-source equivalents: 0.57.19.1, 0.58.14.1, 0.59.10, 0.60.4). Organizations should upgrade to one of these versions immediately. As a short-term workaround, restrict administrator access to Metabase to trusted personnel only, and audit existing MySQL/MariaDB database connection configurations for unexpected or suspicious JDBC parameters. Network-level controls limiting outbound connections from the Metabase server to only known, trusted database hosts can reduce the attack surface (GitHub Advisory).

The vulnerability was noted on Mastodon via The Hacker Wire shortly after disclosure, indicating some community awareness. No major vendor statements beyond the official Metabase GitHub Security Advisory have been identified, and no significant independent researcher commentary or media coverage has been observed as of the report date (GitHub Advisory).