CVE-2026-103928

Executive Summary

Metabase, an open source business intelligence and analytics platform, contains an external control of file name or path vulnerability (CWE-73) in its handling of native queries and actions executed against an H2 data source. From version 1.55.0 until the fixed releases (1.58.16, 1.59.13, 1.60.9, and 1.61.4), user-supplied H2 SQL is passed through without restricting host-facing built-in functions, enabling an authenticated user with permission to run native queries or actions to read or write arbitrary files on the Metabase server or link external databases. Because the default sample database uses H2, the vulnerable surface is exposed out of the box, making the risk particularly acute for internet-facing Metabase instances and multi-tenant deployments where less-privileged users hold native query permissions. The vulnerability is currently unpatched per tracked sources (patch confidence 0/4), though vendor-released fixed versions are identified in the NVD description.

Technical Analysis

The core issue is improper neutralization of file path control (CWE-73) within Metabase's query execution layer. Metabase supports "native queries" — raw SQL authored by users — and "actions" that execute database statements. When the underlying data source is H2 (an embedded Java SQL database), Metabase forwards the user's SQL to the H2 engine without filtering host-facing built-in functions.

H2 exposes a set of built-in functions that interact directly with the host operating system and JVM filesystem. The NVD description explicitly identifies the dangerous functions: FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA. These functions allow an attacker with query-execution capability to:

• FILE_READ / CSVREAD: read arbitrary files accessible to the Metabase server process (e.g., configuration files, credentials, database files).
• FILE_WRITE / CSVWRITE: write arbitrary files to paths writable by the Metabase process, potentially enabling persistence or code execution depending on file type and deployment.
• LINK_SCHEMA: link another database schema into the H2 instance, expanding the attack surface to external data stores reachable from the host.

The vulnerability is present from Metabase 1.55.0 onward and affects the 1.58.x, 1.59.x, 1.60.x, and 1.61.x release lines up to the patched versions. The default sample database shipped with Metabase uses H2, so a stock installation inherently exposes an H2 data source, lowering the bar for exploitation.

Attack surface: any Metabase deployment where a user holds the "native query" or "action" privilege against an H2-backed data source. The vulnerability requires authentication (a valid Metabase account) but not administrative privileges — this is a privilege-bounded but high-impact file system exposure.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred directly from the NVD description and vulnerability class. Only function names and mechanisms explicitly enumerated in the description are used.

1. Reconnaissance / target identification. An attacker identifies an internet-facing or internal Metabase instance (fingerprintable via HTTP title/product). The attacker needs an authenticated account with permission to run native queries or, failing that, valid credentials obtainable through unrelated means.

2. Triggering the flaw. Using the native query editor (or an action) bound to an H2 data source — including the default sample database — the attacker submits SQL that references one of the host-facing built-in functions. For example, a query invoking FILE_READ to retrieve a server-side file, or FILE_WRITE/CSVWRITE to write content to a chosen path. The description states these functions are "passed through without restricting host-facing built-in functions," so no bypass of a filter is required where the feature is reachable.

3. Payload/execution method (class-level). Because H2's built-in functions operate at the host filesystem level, the SQL statement itself serves as the payload. The attacker need not exploit a memory-corruption bug; the abusive capability is an intended database feature misused through Metabase's unfiltered query passthrough. LINK_SCHEMA can be used to extend access to additional databases, and CSVREAD provides an alternative file-read path to FILE_READ.

4. Post-exploitation impact. Successful exploitation achieves unauthorized read and/or write of arbitrary files on the Metabase server, which typically yields exposure of secrets (configuration, credentials) and potential integrity compromise of server-side files. Linking additional schemas broadens lateral reach to other data stores. The scope is changed (S:C in the vector) because the vulnerable component's behavior can affect resources beyond its security scope — the host filesystem and linked databases.

Impact Assessment

• Confidentiality (High): arbitrary file read (FILE_READ, CSVREAD) can disclose configuration, credentials, and database contents.
• Integrity (High): arbitrary file write (FILE_WRITE, CSVWRITE) can modify server-side files, with further escalation depending on deployment (e.g., writable artifacts consumed by the application or OS).
• Availability (High): file modification/deletion or schema-linking abuse can disrupt service and data integrity.
• Scope (Changed): the impact crosses the security boundary of the Metabase query component into the host OS and external databases via LINK_SCHEMA.
• Privileges Required (Low) / User Interaction (None) / Attack Vector (Network): exploitation requires only an authenticated account with native query/action rights over an H2 source.

Blast radius: Every Metabase 1.55.0+ deployment exposing an H2 data source to non-administrative query authors. The default sample database ensures out-of-the-box exposure. Multi-tenant Metabase instances, BI-as-a-service platforms, and internal analytics portals with broad "native query" grants face the greatest risk. Business impact includes exposure of sensitive analytics data and server secrets, reputational harm, and potential regulatory exposure. No EPSS score is available (not yet scored by FIRST.org), and the CVE is not listed in CISA KEV as of this report.

Detection Guidance

Sigma Rule

title: Metabase H2 Host-Facing Function Abuse via Native Query
id: 8f2a1c34-9b7e-4d2a-9c11-7e6f5a0b3d21
status: experimental
description: Detects native query or action text invoking H2 host-facing built-in functions (FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, LINK_SCHEMA) through Metabase, indicating potential CWE-73 file access abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103928
author: valtersit.com
date: 2026/01/01
logsource:
  product: metabase
  category: application
detection:
  selection_fn:
    query|contains:
      - 'FILE_READ'
      - 'FILE_WRITE'
      - 'CSVREAD'
      - 'CSVWRITE'
      - 'LINK_SCHEMA'
  selection_ctx:
    query|contains: 'SELECT'
  condition: selection_fn and selection_ctx
falsepositives:
  - Legitimate administrative maintenance queries against H2 (rare; review source user)
level: high
tags:
  - attack.t1190
  - cwe.73

YARA Rule

rule CVE_2026_103928_Metabase_H2_Function_Abuse
{
    meta:
        description = "Detects H2 host-facing built-in function usage indicative of CVE-2026-103928 exploitation"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103928"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fn1 = "FILE_READ" ascii nocase
        $fn2 = "FILE_WRITE" ascii nocase
        $fn3 = "CSVREAD" ascii nocase
        $fn4 = "CSVWRITE" ascii nocase
        $fn5 = "LINK_SCHEMA" ascii nocase
        $mb1 = "metabase" ascii nocase
        $h2  = "org.h2" ascii nocase

    condition:
        (any of ($fn*)) and (any of ($mb1, $h2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103928 Metabase H2 Host Function Abuse Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/dataset"; nocase; http.request_body; content:"FILE_READ"; nocase; http.request_body; content:"FILE_WRITE"; nocase; http.request_body; content:"CSVREAD"; nocase; http.request_body; content:"CSVWRITE"; nocase; http.request_body; content:"LINK_SCHEMA"; nocase; classtype:attempted-admin; reference:cve,2026-103928; sid:2026103928; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where event.category == "web" and
      process.name == "java" and
      stringContains(network.protocol, "http") and
      stringContains(url.path, "/api/dataset") ]
  [ any where event.category == "database" and
      ( stringContains(database.statement, "FILE_READ") or
        stringContains(database.statement, "FILE_WRITE") or
        stringContains(database.statement, "CSVREAD") or
        stringContains(database.statement, "CSVWRITE") or
        stringContains(database.statement, "LINK_SCHEMA") ) ]

Splunk SPL Query

index=web OR index=app sourcetype=metabase*
| search ("FILE_READ" OR "FILE_WRITE" OR "CSVREAD" OR "CSVWRITE" OR "LINK_SCHEMA")
| eval risk="possible CVE-2026-103928 H2 function abuse"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(user) as users values(src_ip) as src_ips
        by host, uri_path, risk
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="metabase,cve-2026-103928,">
  <rule id="100928" level="12">
    <decoded_as>json</decoded_as>
    <field name="query">\.</field>
    <regex type="pcre2">(?i)(FILE_READ|FILE_WRITE|CSVREAD|CSVWRITE|LINK_SCHEMA)</regex>
    <description>CVE-2026-103928: Possible Metabase H2 host-facing function abuse via native query/action</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_73,attack_initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor workaround is documented in the supplied data; the following measures are defense-in-depth recommendations. The NVD description states the issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4 — enterprises should track these releases and validate them against vendor advisories before deployment.

1) Immediate mitigations

• Remove or disable H2 data sources wherever not strictly required; do not rely on the default sample database in production and remove it if present.
• Revoke native query and action privileges from non-administrative groups; restrict these capabilities to trusted, audited users.
• Restrict network access to Metabase (segment from untrusted networks, enforce authentication, disable public embedding where feasible).
• Monitor query logs and application/database logs for the functions FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA (see detection rules above).

2) Patch/upgrade steps

• Upgrade to Metabase 1.58.16, 1.59.13, 1.60.9, or 1.61.4 (or later) per the NVD description. Confirm the fix through the vendor channel since no independent patch artifact is present in tracked sources.
• Take a full backup before upgrading and re-validate H2 data source behavior post-upgrade.

3) Long-term hardening

• Apply least privilege to Metabase roles and audit native query/action grants regularly.
• Replace H2 with a managed, network-isolated database where possible; avoid embedded databases for analytics on internet-facing instances.
• Implement application-level egress/ingress controls and file-integrity monitoring on the Metabase host.
• Track upcoming advisories; the CVE carries no EPSS score yet and is not in CISA KEV, so re-assess upon new scoring.

References

• NVD — CVE-2026-103928: https://nvd.nist.gov/vuln/detail/CVE-2026-103928
• MITRE CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• H2 Database documentation — built-in functions: https://h2database.com/html/functions.html
• Metabase security advisories (vendor channel): https://github.com/metabase/metabase/security/advisories

No public PoC, exploit code, Nuclei template, or CISA KEV entry is associated with this CVE as of this report. No specific threat-actor campaign or exploit-in-the-wild activity is evidenced in the provided data; exploitation potential is inferred from the vulnerability class (CWE-73) and the explicitly named H2 functions.