{"id":"CVE-2026-92813","summary":"Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass","details":"Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.","modified":"2026-09-19T03:30:56.757693752Z","published":"2026-09-16T20:32:58.969Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92813.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92813.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92813"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/metabase-through-0.63.18-ssrf-via-geojson-url-validation-bypass"},{"type":"PACKAGE","url":"https://github.com/metabase/metabase"},{"type":"ARTICLE","url":"https://github.com/metabase/metabase/blob/v0.61.2/src/metabase/geojson/api.clj#L26-L47"},{"type":"EVIDENCE","url":"https://github.com/geo-chen/oss/blob/main/metabase.md#finding-2-geojson-ssrf-bypass-via-0000-address"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/metabase/metabase","events":[{"introduced":"0"},{"fixed":"2ba2485c78d7e00a9a25f82c00fc201da71590c4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.63.18"},{"fixed":"0.63.18"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v0.63.17.3","v0.63.17.2","v0.63.17.1","v0.63.17.x","v0.63.17","v0.63.16.9","v0.63.16.8","v0.63.16.7","v0.63.16.6","v0.63.16.5","v0.63.16.4","v0.63.16.3","v0.63.16.2","v0.63.16.1","v0.63.16.x","v0.63.16","v0.63.15.7","v0.63.15.6","v0.63.15.5","v0.63.15.4","v0.63.15.3","v0.63.15.2","v0.63.15.1","v0.63.15.x","v0.63.15","v0.63.14.3","v0.63.14.2","v0.63.14.1","v0.63.14.x","v0.63.14","v0.63.2.7","v0.63.2.6","v0.63.2.5","v0.63.2.4","v0.63.2.3","v0.63.2.2","v0.63.2.1","v0.63.2.x","v0.63.2","v0.63.1.12","v0.63.1.11","v0.63.1.10","v0.63.1.9","v0.63.1.8","v0.63.1.7","v0.63.1.6","v0.63.1.5","v0.63.1.4","v0.63.1.3","embedding-sdk-0.63.1","v0.63.1.2","v0.63.1.1","embedding-sdk-63-stable","embedding-sdk-0.63.0","v0.63.1.x","v0.63.1","v0.63.0.6-beta","v0.63.0.5-beta","v0.63.0.4-beta","v0.63.0.3-beta","v0.63.0.2-beta","v0.63.0.x","v0.63.0.1-beta","v0.63.x","v0.63.0-beta","custom-viz-v1.0.4","custom-viz-v1.0.3","custom-viz-v1.0.2","custom-viz-v1.0.1","custom-viz-v1.0.0","v0.60.0-beta","embedding-sdk-0.57.0-alpha.3","embedding-sdk-0.57.0-alpha.2","embedding-sdk-0.57.0-alpha.1","embedding-sdk-0.57.0-alpha.0","v0.55.0-beta","beta-oss","beta-ee","embedding-sdk-0.55.1-nightly","embedding-sdk-0.54.3-nightly","embedding-sdk-0.54.2-nightly","embedding-sdk-0.54.1-nightly","embedding-sdk-0.53.1-nightly","embedding-sdk-0.52.4-nightly","embedding-sdk-0.52.3-nightly","v1.52.0-beta","v0.52.0-beta","embedding-sdk-0.52.2-nightly","embedding-sdk-1.52.1","embedding-sdk-0.52.1-nightly","embedding-sdk-0.1.38","embedding-sdk-0.1.37","embedding-sdk-0.1.36","embedding-sdk-0.1.35","embedding-sdk-0.1.34","embedding-sdk-0.1.33","embedding-sdk-0.1.32","embedding-sdk-0.1.31","embedding-sdk-0.1.30","embedding-sdk-0.1.29","embedding-sdk-0.1.28","embedding-sdk-0.1.27","embedding-sdk-0.1.26","embedding-sdk-0.1.25","embedding-sdk-0.1.24","embedding-sdk-0.1.23","embedding-sdk-0.1.22","embedding-sdk-0.1.21","embedding-sdk-0.1.20","embedding-sdk-0.1.19","embedding-sdk-0.1.18","embedding-sdk-0.1.17","embedding-sdk-0.1.16","embedding-sdk-0.1.15","embedding-sdk-0.1.14","embedding-sdk-0.1.13","embedding-sdk-0.1.12","embedding-sdk-0.1.11","embedding-sdk-0.1.10","embedding-sdk-0.1.9","embedding-sdk-0.1.8","embedding-sdk-0.1.7","embedding-sdk-0.1.6","embedding-sdk-0.1.5","embedding-sdk-0.1.4","embedding-sdk-0.1.2","embedding-sdk-0.1.0","v1.48.0-RC1","v0.48.0-RC1","v1.47.0-RC1","v0.47.0-RC1","v1.45.0-RC2","v0.45.0-RC2","v1.45.0-RC1","v0.45.0-RC1","rm","v1.44.0-RC1","v0.44.0-RC1","v1.43.0-rc1","v0.43.0-rc1","v1.42.0-rc2","v1.42.0-preview1","v0.42.0-preview1","v1.41.0-RC1","v0.41.0-RC1","v1.40.0","v0.40.0","v1.40.0-rc2","v0.40.0-rc2","v0.40.0-rc1-dan","v0.38.0-rc4","v0.38.0-rc3","v0.38.0-rc2","v0.38.0-rc1","v0.38.0-preview","v0.37.0-rc2","v0.36.0-snapshot","v0.35.0","v0.35.0-rc2","v0.35.0-rc1","blah","0.34.0-rc1","v0.26.0.RC1","v0.13.0","v0.12.0","v0.12.0-test","v0.11.3","v0.11.2","v0.11.1","v0.10.4.1","v0.11.0","v0.10.4","v0.10.3","0.10.3","v0.10.0","v0.9-final","v20150604-alpha","v20150603-alpha","v20150601-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92813.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}