{"id":"CVE-2026-92813","title":"Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services","summary":"Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trig…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"metabase","product":"Metabase","affected":["Metabase <= 0.63.18"],"published":"2026-09-16","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:25:55.870","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92813","references":[{"url":"https://github.com/geo-chen/oss/blob/main/metabase.md#finding-2-geojson-ssrf-bypass-via-0000-address","label":"disclosure@vulncheck.com"},{"url":"https://github.com/metabase/metabase","label":"disclosure@vulncheck.com"},{"url":"https://github.com/metabase/metabase/blob/v0.61.2/src/metabase/geojson/api.clj#L26-L47","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/metabase-through-0.63.18-ssrf-via-geojson-url-validation-bypass","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00288,"epssPercentile":0.21615,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T13:42:08.864784Z"},"ingestedAt":"2026-09-16T21:05:36.881Z","slug":"CVE-2026-92813","body":"## Overview\n\nMetabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":206107,"id":"CVE-2026-92813","ts":1789654824784,"field":"exploit_available","old":"false","new":"true"}]}