Update Metabase and Fortinet Systems to Fix Critical SQL Injection Flaws

Security teams must prioritize updating Metabase instances running versions prior to 1.58.16, 1.59.13, 1.60.9, or 1.61.4. These specific releases contain a critical vulnerability that allows attackers to read or write files on the server. The flaw stems from unrestricted native queries against H2 data sources. Users authorized to run these queries can exploit built-in functions to access the underlying file system.

In plain English

The Metabase flaw allows a user with permission to run native queries to bypass safety restrictions. They can use commands like FILE_READ or FILE_WRITE to access any file on the server where Metabase is installed. The default sample database in Metabase uses H2, meaning this vulnerable surface is exposed by default for many installations. This means an attacker does not need to configure complex settings to reach the flaw.

The background

According to the National Vulnerability Database, the issue affects Metabase from version 1.55.0 through specific earlier builds of 1.58, 1.59, 1.60, and 1.61. The flaw is rated critical with a CVSS score of 9.3. It is classified under CWE-73. The vulnerability allows linking other databases or manipulating files directly through the analytics platform. Separately, FortiGuard PSIRT issued an advisory for FortiAnalyzer, FortiManager, and their cloud counterparts. That flaw, rated high severity with a CVSS of 7.9, is classified as CWE-89 and allows low-privileged users to execute arbitrary commands via crafted requests.

What changes now

Patches are available for Metabase versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4. Administrators should update to these specific builds immediately to close the file access gap. The Fortinet advisory was revised on 2026-10-13. No fix has been confirmed yet for the Fortinet products in the source material.

Who needs to act first

Teams usually prioritize systems exposed to the internet or internal networks with untrusted users. Check whether your Metabase instance runs a vulnerable version listed in the advisory. If so, schedule an immediate update to the patched release. For Fortinet products, assess if low-privileged accounts have access to the affected interfaces. Roll out fixes in a test environment first to ensure stability.

Back up configurations before applying updates. If a patch is not immediately available, restrict access to the vulnerable services using network segmentation. Monitor logs for unusual query activity that might indicate exploitation attempts. Limit the permissions of users who can run native queries to reduce the attack surface until a permanent fix is deployed.

What to do and how to stay safe: Metabase

• Verify your Metabase version against the list of affected builds and update to the patched release if vulnerable.
• Check FortiAnalyzer and FortiManager installations for the specific SQL injection advisory and apply available mitigations.
• Restrict user permissions for running native queries in Metabase to only those who strictly require them.
• Monitor server logs for unexpected file access attempts or unusual database linking activities that could signal an exploit.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems

General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Metabase versions are affected by the critical SQL injection flaw?

Versions from 1.55.0 up to 1.58.15, 1.59.0 to 1.59.12, 1.60.0 to 1.60.8, and 1.61.0 to 1.61.3 are affected.

Is there a fix for the Fortinet SQL injection vulnerability?

The source material states the advisory was revised but does not confirm if a patch has been released for FortiAnalyzer or FortiManager.

What is the CVSS score for the Metabase vulnerability?

The National Vulnerability Database rates the Metabase flaw as critical with a CVSS score of 9.3.