FortiAnalyzer and Metabase SQL Injection Flaws Permit Low-Privilege File Access

Security researchers have identified SQL injection flaws in Fortinet management tools and Metabase analytics platforms that allow attackers to manipulate database queries. These weaknesses enable low-privileged users to execute arbitrary commands or access files on the host systems, according to recent advisories.

Root cause

The Fortinet vulnerability stems from improper neutralization of special elements in SQL commands, classified as CWE-89. This flaw exists in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud. According to the FortiGuard PSIRT advisory revised on 13 October 2026, crafted requests can bypass input validation. In Metabase, native queries against H2 data sources pass through without restricting host-facing built-in functions. This allows invocation of file-read and file-write operations, as noted in the NVD record for CVE-2026-103928.

Attack path

An attacker with low privileges can send crafted requests to the Fortinet appliances to execute arbitrary commands. For Metabase, a user authorised to run native queries or actions can invoke functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE or LINK_SCHEMA. This enables reading or writing arbitrary files on the server or linking other databases. The default sample database in Metabase uses H2, exposing this vulnerable surface by default, according to the NVD description.

Affected versions

FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud are affected by the SQL injection flaw. Metabase versions from 1.55.0 until 1.58.16, 1.59.13, 1.60.9 and 1.61.4 are vulnerable. Specifically, versions 1.55.0 to 1.58.15, 1.59.0 to 1.59.12, 1.60.0 to 1.60.8 and 1.61.0 to 1.61.3 are at risk. The issue is fixed in Metabase versions 1.58.16, 1.59.13, 1.60.9 and 1.61.4.

Mitigation

• Update Metabase to versions 1.58.16, 1.59.13, 1.60.9 or 1.61.4 to resolve the file access flaw.
• Monitor Fortinet advisories for patches addressing the SQL injection in FortiAnalyzer and FortiManager.
• Restrict user permissions to prevent low-privileged accounts from executing native queries or sending crafted requests.
• Audit H2 database configurations in Metabase to ensure host-facing functions are not accessible to standard users.

Why it matters

SQL injection allows attackers to interfere with database queries, often leading to data theft or system control. When combined with database-specific functions, this can escalate to file system access. Teams usually restrict native query capabilities to trusted administrators only. Checking whether default databases expose sensitive functions helps reduce risk. Monitoring for unusual file access patterns can detect exploitation attempts early. Understanding these layers helps organisations prioritise remediation efforts effectively.

What to do and how to stay safe

• Inventory all Metabase instances and verify they are updated to the latest fixed versions listed above.
• Review Fortinet appliance logs for signs of crafted requests or unusual command execution attempts.
• Limit access to native query features in analytics platforms to essential personnel only.
• Implement network segmentation to isolate management consoles from general user traffic.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a patch for the Fortinet SQL injection vulnerability?

No fix has been confirmed yet for FortiAnalyzer, FortiManager and their cloud variants, according to the FortiGuard advisory.

Which Metabase versions are affected by CVE-2026-103928?

Versions from 1.55.0 until 1.58.16, 1.59.13, 1.60.9 and 1.61.4 are vulnerable, as stated in the NVD record.