SQL Injection in Fortinet and Metabase Enables Arbitrary File Operations
Security teams face high-severity SQL flaws in Fortinet appliances and Metabase analytics platforms that permit arbitrary file read and write actions.
Key points
- FortiGuard PSIRT rates the Fortinet SQL injection vulnerability at CVSS 7.9 high severity.
- NVD assigns a critical CVSS 9.3 score to the Metabase flaw affecting native query functions.
- Both issues allow low-privileged users to execute arbitrary commands or manipulate server files.
Security advisories released in October 2026 highlight significant SQL injection vulnerabilities in Fortinet management appliances and the Metabase analytics platform. These flaws enable attackers to perform arbitrary file operations and execute commands, posing a severe risk to infrastructure integrity.
What happened
FortiGuard PSIRT published an advisory on 13 October 2026 detailing an improper neutralisation of special elements in SQL commands within FortiAnalyzer, FortiManager and their cloud counterparts. The vulnerability, rated high severity with a CVSS score of 7.9, allows a low-privileged user to execute arbitrary commands via crafted requests. This issue affects multiple Fortinet products used for centralised log management and policy administration.
The National Vulnerability Database recorded CVE-2026-103928 for a separate but related class of vulnerability in Metabase. This open-source business intelligence platform is rated critical with a CVSS score of 9.3. The flaw exists in versions from 1.55.0 up to specific patched releases, where native queries against H2 data sources are not sufficiently restricted.
Why it matters
The Metabase vulnerability is particularly dangerous because the default sample database uses H2, meaning the attack surface is exposed by default for many installations. Users authorised to run native queries can invoke functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE or LINK_SCHEMA. This capability allows an attacker to read or write arbitrary files on the Metabase server or link other databases, potentially leading to full system compromise.
For Fortinet environments, the ability for a low-privileged user to execute arbitrary commands via SQL injection undermines the principle of least privilege. Security operations teams must assume that any authenticated user with access to these interfaces could potentially escalate privileges. The combination of widespread deployment and default exposure in Metabase increases the likelihood of exploitation in unpatched environments.
Next steps
- Verify if your Metabase instance falls within the affected version ranges, specifically 1.55.0 through 1.58.15, 1.59.0 through 1.59.12, 1.60.0 through 1.60.8, or 1.61.0 through 1.61.3.
- Check FortiAnalyzer and FortiManager versions against the FortiGuard PSIRT advisory to determine if they require updates to mitigate the high-severity SQL injection flaw.
- Restrict access to native query execution in Metabase to only those users who strictly require it for administrative tasks.
- Monitor network traffic for unusual data exfiltration patterns that might indicate file reading or database linking activities.
Detection notes
Security teams should monitor database logs for unexpected native query executions, particularly those invoking file system functions like FILE_READ or CSVWRITE. Look for anomalies in user behaviour where low-privileged accounts attempt to access sensitive system files or link external databases. Check web server logs for crafted SQL requests that deviate from standard application patterns. If suspicious activity is detected, immediately isolate the affected server to prevent lateral movement. Review authentication logs for unauthorised access attempts to management interfaces. Contain the threat by disabling the vulnerable query capabilities until patches are applied.
Background: Principle of least privilege
Least privilege restricts user access to the minimum resources required for their current task. It is often mistaken for role-based access control or password strength. Correct application requires continuous verification, immediate revocation, and strict separation of duties to prevent unauthorized access.
Read the full guide: Principle of Least Privilege: Correcting Common Misinterpretations
What to do and how to stay safe: Fortinet
- Audit all Metabase installations to ensure they are updated to versions 1.58.16, 1.59.13, 1.60.9 or 1.61.4, which contain the fix.
- Apply the latest security updates to FortiAnalyzer and FortiManager systems as recommended by FortiGuard PSIRT.
- Implement strict input validation and parameterised queries across all internal applications to mitigate SQL injection risks.
- Enable detailed logging for all database interactions to facilitate rapid detection of malicious query attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Metabase versions are vulnerable to CVE-2026-103928?
Versions from 1.55.0 until 1.58.16, 1.59.13, 1.60.9 and 1.61.4 are affected by this critical SQL injection flaw.
What is the severity rating for the Fortinet vulnerability?
FortiGuard PSIRT rates the Fortinet SQL injection vulnerability as high severity with a CVSSv3 score of 7.9.
How can attackers exploit the Metabase flaw?
Attackers can invoke H2 built-in functions like FILE_READ or LINK_SCHEMA through native queries to read, write or link files on the server.
