CVE-2026-92813

Executive Summary

CVE-2026-92813 is a Server-Side Request Forgery (SSRF) vulnerability in Metabase through version 0.63.18, caused by improper validation of the unspecified address 0.0.0.0 in custom GeoJSON URLs. An authenticated attacker can save a malicious GeoJSON entry pointing to 0.0.0.0 and subsequently trigger requests that cause the Metabase server to reach loopback-only services, returning their responses to unauthenticated callers. The CVSS score is 4.9, reflecting the requirement for high privileges to configure the malicious entry but high confidentiality impact once successfully exploited.

Technical Analysis

Metabase, an open-source business intelligence and analytics platform, allows users to supply custom GeoJSON URLs for map visualizations. The flaw lies in how the application validates these URLs before fetching their contents. By failing to properly restrict the unspecified address 0.0.0.0, Metabase permits a stored configuration that points the server-side request mechanism at the loopback interface.

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). In a typical SSRF scenario, the attacker manipulates a server-side request to reach internal-only resources. Here, the attack surface is the GeoJSON URL configuration feature. When a user with sufficient privileges (as indicated by the CVSS vector PR:H) saves a GeoJSON entry using 0.0.0.0, the server later resolves and fetches that address. On many systems, 0.0.0.0 is treated as a synonym for 127.0.0.1 or the local host, allowing the request to bypass filters that only block explicit loopback addresses such as 127.0.0.1 or localhost. Because the resulting map data is then rendered and available to unauthenticated callers (as stated in the NVD description), sensitive responses from internal loopback services can be exfiltrated without any authentication.

The CVSS vector AV:N (network) confirms the attack can be launched remotely. AC:L indicates low attack complexity. PR:H shows that the attacker must possess high privileges—likely an administrative or analytics-user role capable of configuring data sources or map settings. UI:N means no user interaction is required beyond the attacker's own configuration steps. The scope is unchanged (S:U), with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N). This reflects that the primary consequence is information disclosure from internal services, not direct modification or denial of service.

No patch or workaround has been documented by the vendor, and no public proof-of-concept or exploit code is available. The precise code path (e.g., validation function names, endpoint URLs, or parameter names) is not disclosed in the NVD description, so further implementation details cannot be provided without speculation.

Exploitation Scenarios

The attack chain for CVE-2026-92813 can be described at the vulnerability-class level, based strictly on the information provided:

1. Reconnaissance/Target Identification: The attacker identifies an exposed Metabase instance running version 0.63.18 or earlier. This may be done through Shodan searches using dorks such as http.title:"Metabase" or http.html:"metabase". The attacker must have valid credentials with high privileges, as the vulnerability requires authenticated access to configure GeoJSON entries.

2. Triggering the Flaw: Once authenticated, the attacker navigates to the map or GeoJSON configuration feature and saves a new custom GeoJSON URL pointing to 0.0.0.0. Because the application fails to validate this unspecified address, the entry is stored successfully.

3. Payload/Execution: The attacker then triggers a request that causes the Metabase server to fetch the GeoJSON content from 0.0.0.0. On many operating systems, 0.0.0.0 resolves to the loopback interface, so the server-side request reaches local services bound to that interface. The response from the internal service is then returned as the GeoJSON payload. No public PoC is available; this execution method is inferred from the standard behavior of 0.0.0.0 and the SSRF vulnerability class.

4. Post-Exploitation Impact: The attacker can view the responses from loopback services. If those services contain sensitive data (e.g., internal APIs, metadata endpoints, administrative interfaces), the attacker can read that information. Because the map data is accessible to unauthenticated callers, the attacker may also expose this information to others or exfiltrate it themselves. The high confidentiality impact (C:H) underscores the risk of sensitive data leakage.

Impact Assessment

Successful exploitation allows an attacker with high privileges to use the Metabase server as a proxy to reach loopback-only services. This can lead to the disclosure of sensitive internal information, such as API responses, configuration data, or service metadata, depending on what is listening on the loopback interface. The CVSS score of 4.9 reflects a moderate severity: while high privileges are required, the confidentiality impact is high, and no user interaction is needed. The blast radius includes any Metabase instance exposed to the network that has users with the ability to configure GeoJSON entries. Because the resulting data is available to unauthenticated callers, the attack could also serve as a pivot point for further internal reconnaissance. Integrity and availability are not directly impacted, but the information gleaned could facilitate subsequent attacks. No evidence of active exploitation or CISA KEV listing exists at this time.

Detection Guidance

Sigma Rule

title: Metabase GeoJSON SSRF via 0.0.0.0
id: 8f4b3c2a-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2026-92813 by saving a GeoJSON URL containing 0.0.0.0
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  product: metabase
  service: audit
detection:
  selection:
    event: "geojson-url-update"
    url|contains: "0.0.0.0"
  condition: selection
falsepositives:
  - Legitimate use of 0.0.0.0 in GeoJSON URLs by mistake
level: high

YARA Rule

rule CVE_2026_92813_Metabase_SSRF
{
    meta:
        description = "Detects references to 0.0.0.0 in Metabase GeoJSON configuration"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92813"
        severity = "high"
    strings:
        $s1 = "0.0.0.0" ascii wide
        $s2 = "geojson" ascii wide nocase
        $s3 = "custom-geojson" ascii wide nocase
    condition:
        any of ($s1) and any of ($s2, $s3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92813 Metabase GeoJSON SSRF Attempt"; flow:to_server,established; http.uri; content:"/api/geojson"; http.request_body; content:"0.0.0.0"; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name == "java" and process.args : "*metabase*"]
  [network where destination.ip == "0.0.0.0" and network.direction == "outgoing"]

Splunk SPL Query

index=metabase sourcetype=metabase:audit
| search "geojson" AND "0.0.0.0"
| table _time, user, action, url, status
| sort - _time

Wazuh OSSEC Rule

<group name="metabase,ssrf">
  <rule id="100200" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">geojson-url-update</field>
    <field name="url">0.0.0.0</field>
    <description>CVE-2026-92813: Metabase GeoJSON SSRF attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict access to Metabase configuration features to trusted administrators only.
   • Implement network-level controls to block outbound requests to 0.0.0.0 and other loopback addresses from the Metabase server.
   • Monitor audit logs for GeoJSON URL updates containing 0.0.0.0 and alert on such events.
   • If possible, disable the custom GeoJSON URL feature for non-administrative users.

2. Patch/Upgrade Steps:

   • No vendor patch is available. Monitor the Metabase GitHub repository and official security advisories for updates.
   • Once a fixed version is released, upgrade immediately and verify that the vulnerability is remediated.

3. Long-Term Hardening:

   • Enforce strict URL validation for all server-side requests, including blocking private IP ranges, loopback addresses, and unspecified addresses like 0.0.0.0.
   • Apply the principle of least privilege to Metabase user roles, ensuring only necessary users can modify map settings.
   • Deploy SSRF-specific protections such as egress filtering and network segmentation to limit internal reachability.

References

• NVD – CVE-2026-92813
• Metabase Official Website
• CWE-918: Server-Side Request Forgery
• MITRE ATT&CK T1190
• OWASP SSRF Prevention Cheat Sheet

No known threat actor campaigns or exploit-in-the-wild evidence is available for this CVE at this time.