{"id":"CVE-2026-22805","summary":"Metabase channel test endpoint can reach internal local addresses","details":"Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.","aliases":["GHSA-2wgg-7r2p-cmqx"],"modified":"2026-08-12T03:51:42.024809028Z","published":"2026-01-12T22:36:35.272Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22805.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.57.0-beta"},{"fixed":"57.1"},{"introduced":"0.56.0-beta"},{"fixed":"56.3"},{"fixed":"55.13"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22805.json"},{"type":"ADVISORY","url":"https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22805"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/metabase/metabase","events":[{"introduced":"0"},{"fixed":"103ac02781f884a3ca7adf371a1d92081acfd7ae"},{"introduced":"3a032f67171d02a61695d5591ef5b51411926a59"},{"fixed":"6d086c35e51d10a223eff08f6e54fc7fcff8e6bd"},{"introduced":"2e9f645974142f1377e2e58b92a425e9c66e49f9"},{"last_affected":"2e9f645974142f1377e2e58b92a425e9c66e49f9"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*","cpe:2.3:a:metabase:metabase:0.57.0:beta:*:*:-:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"0.55.13"},{"introduced":"0.56.0"},{"fixed":"0.56.3"},{"introduced":"0.57.0-beta"},{"last_affected":"0.57.0-beta"}]}}],"versions":["0.57.0-beta","v0.57.0-beta","v0.55.8","v0.56.3.6","embedding-sdk-0.56.3","v0.56.3.5","v0.56.3.4","v0.56.3.3","v0.56.3.2","v0.55.13","v0.56.3.1","v0.56.3","v0.56.2.x","v0.56.2.4","v0.55.12.5","v0.55.12.x","v0.55.12.6","v0.56.2.3","v0.55.12.4","v0.55.12.3","v0.55.12","v0.56.2.2","v0.56.2","v0.55.11.x","v0.55.11.2","v0.56.1.x","v0.56.1.5","v0.55.12.1","v0.56.2.1","v0.55.12.2","v0.56.1.4","embedding-sdk-0.56.2","v0.56.1.3","v0.56.1.2","v0.55.11.1","v0.55.11","v0.56.1.1","v0.56.1","v0.55.10.5","v0.56.0.x","v0.56.0.3-beta","v0.55.10.4","v0.55.10.x","v0.55.10.6","v0.55.10.3","v0.55.10.2","v0.55.10.1","v0.55.10","v0.55.9.x","v0.55.9.5","v0.55.9.4","embedding-sdk-55-stable","embedding-sdk-0.55.5","v0.55.9.3","v0.55.9.2","v0.55.9","v0.55.9.1","v0.55.8.x","v0.55.8.6","v0.55.8.5","v0.55.8.4","v0.55.8.3","v0.55.8.2","v0.55.8.1","v0.55.7.x","v0.55.7.4","v0.55.7.3","v0.55.7.2","v0.55.7.1","v0.55.7","v0.55.6.x","v0.55.6.3","embedding-sdk-0.55.4","v0.55.6.2","v0.55.6.1","v0.55.5.x","v0.55.5.5","v0.55.6","v0.55.5.4","v0.55.5.3","v0.55.5.2","v0.55.5.1","v0.55.5","v0.55.4.x","v0.55.4.5","v0.55.4.4","v0.55.4.3","v0.55.4.2","v0.55.4","v0.55.4.1","v0.55.3.x","v0.55.3.3","embedding-sdk-0.55.3","v0.55.3.2","v0.55.3","v0.55.3.1","v0.55.2.x","v0.55.2.2","v0.55.2.1","v0.55.2","v0.55.1.x","v0.55.1.4","v0.55.1.3","embedding-sdk-0.55.2","v0.55.1.2","v0.55.1.1","v0.55.1","v0.55.0.x","v0.55.0.2-beta","v0.55.0.1-beta","embedding-sdk-0.55.2-nightly","v0.55.0-beta","beta-oss","beta-ee","embedding-sdk-0.55.1-nightly","embedding-sdk-0.54.3-nightly","embedding-sdk-0.54.2-nightly","embedding-sdk-0.54.1-nightly","embedding-sdk-0.53.1-nightly","embedding-sdk-0.52.4-nightly","embedding-sdk-0.52.3-nightly","v1.52.0-beta","v0.52.0-beta","embedding-sdk-0.52.2-nightly","embedding-sdk-1.52.1","embedding-sdk-0.52.1-nightly","embedding-sdk-0.1.38","embedding-sdk-0.1.37","embedding-sdk-0.1.36","embedding-sdk-0.1.35","embedding-sdk-0.1.34","embedding-sdk-0.1.33","embedding-sdk-0.1.32","embedding-sdk-0.1.31","embedding-sdk-0.1.30","embedding-sdk-0.1.29","embedding-sdk-0.1.28","embedding-sdk-0.1.27","embedding-sdk-0.1.26","embedding-sdk-0.1.25","embedding-sdk-0.1.24","embedding-sdk-0.1.23","embedding-sdk-0.1.22","embedding-sdk-0.1.21","embedding-sdk-0.1.20","embedding-sdk-0.1.19","embedding-sdk-0.1.18","embedding-sdk-0.1.17","embedding-sdk-0.1.16","embedding-sdk-0.1.15","embedding-sdk-0.1.14","embedding-sdk-0.1.13","embedding-sdk-0.1.12","embedding-sdk-0.1.11","embedding-sdk-0.1.10","embedding-sdk-0.1.9","embedding-sdk-0.1.8","embedding-sdk-0.1.7","embedding-sdk-0.1.6","embedding-sdk-0.1.5","embedding-sdk-0.1.4","embedding-sdk-0.1.2","embedding-sdk-0.1.0","v1.48.0-RC1","v0.48.0-RC1","v1.47.0-RC1","v0.47.0-RC1","v1.45.0-RC2","v0.45.0-RC2","v1.45.0-RC1","v0.45.0-RC1","rm","v1.44.0-RC1","v0.44.0-RC1","v1.43.0-rc1","v0.43.0-rc1","v1.42.0-rc2","v1.42.0-preview1","v0.42.0-preview1","v1.41.0-RC1","v0.41.0-RC1","v1.40.0","v0.40.0","v1.40.0-rc2","v0.40.0-rc2","v0.40.0-rc1-dan","v0.38.0-rc4","v0.38.0-rc3","v0.38.0-rc2","v0.38.0-rc1","v0.38.0-preview","v0.37.0-rc2","v0.36.0-snapshot","v0.35.0","v0.35.0-rc2","v0.35.0-rc1","blah","0.34.0-rc1","v0.26.0.RC1","v0.13.0","v0.12.0","v0.12.0-test","v0.11.3","v0.11.2","v0.11.1","v0.10.4.1","v0.11.0","v0.10.4","v0.10.3","0.10.3","v0.10.0","v0.9-final","v20150604-alpha","v20150603-alpha","v20150601-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22805.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"}]}