CVE-2022-39362 - CVE House
Back to Database
Status published High CVE-2022-39362

Metabase vulnerable to arbitrary SQL execution from queryhash

Vulnerability Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39362

Credits & Attribution

No credits recorded in the NVD database.

References

More from metabase

View All →
CVE-2025-32382
Snowflake credentials logged by the Metabase backend
Low 1.8
CVE-2025-30371
Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Low 2.1
CVE-2025-27141
Metabase Enterprise Edition allows cached questions to leak data to impersonated users
Medium 4.8
CVE-2024-55951
Metabase sandboxed users could see filter values from other sandboxed users
Medium 4.8
CVE-2023-37470
Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
Critical 10

Affected Vendor

Affected Software

metabase
Vulnerable Versions:
< 0.41.9, >= 0.42.0, < 0.42.6, >= 0.43.0, < 0.43.7, >= 0.44.0, < 0.44.5, >= 1.0.0, < 1.41.9, >= 1.42.0, < 1.42.6, >= 1.43.0, < 1.43.7, >= 1.44.0, < 1.44.5

Timeline

Official Publish: October 26th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-356

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.