Is CVE-2021-41277 (Metabase GeoJSON API Local File Inclusion) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-41277 to its Known Exploited Vulnerabilities catalogue on 12 November 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

What does it mean when CISA says this Metabase flaw is being exploited?

For practitioners, the important signal is not the label “being exploited”, it is that the vulnerability has moved from theoretical exposure to active attacker interest. That changes urgency, triage priority, and the evidence standard you should use when deciding whether to patch, isolate, or monitor first.

The relevant response is to confirm whether Metabase is present anywhere in scope, whether the custom map feature is enabled or reachable, and whether any internet-facing or externally reachable instance could expose the vulnerable API path. If you have multiple environments, treat each one independently, because exploitability and exposure often differ by deployment pattern.

CISA’s KEV listing is a practical prioritisation trigger, so align your response with CISA Known Exploited Vulnerabilities Catalog rather than waiting for a generic patch cycle. For version and record details, confirm the vulnerability entry through the CVE Program and your vendor advisory workflow.

Why local file inclusion becomes a real-world compromise path

local file inclusion is dangerous because it can turn a file-read bug into a broader breach of confidentiality, configuration, or internal application state. In a web application context, that may expose source files, configuration data, credentials stored in files, or other local material that should never be reachable through an API call.

For Metabase, the custom map support in the API is the materialised trust boundary. If the application accepts GeoJSON content or related file references without strict validation, an attacker may be able to steer the application toward unintended local paths. That is why the issue is operationally important even when the initial weakness looks like a narrow parser or feature bug.

A practical way to think about this class of issue is to pair it with broader web-app attack patterns. The Web Application Attacks Guide provides useful context for file inclusion and path traversal style flaws, while the OWASP API Security Top 10 helps frame why exposed API functions must be validated as security boundaries, not just data-handling endpoints.

How to verify exposure and decide what to do next

Start with inventory and reachability, then move to validation. Confirm which Metabase instances exist, whether they are accessible from untrusted networks, whether custom map features are in use, and whether any compensating control such as proxy filtering or application-layer restrictions actually blocks the vulnerable request path. If the asset is business critical, do not assume a low-traffic deployment is low risk.

If patching is delayed, reduce exposure by removing external reachability, restricting administrative access, and monitoring for unusual file access, error patterns, or requests that reference unexpected local paths. A vulnerability of this type can be exploited quickly once discovered, so “watch and wait” is only defensible if you have already reduced the blast radius and can detect abuse.

Use the Zero-Day and Exploited Vulnerabilities Guide for the KEV and emergency-response workflow, and use the Vulnerability Management Guide to turn that signal into a triage decision, remediation SLA, and post-fix verification step. If you need to understand whether related web-app patterns are likely to broaden the issue, the MITRE D3FEND Guide is a useful way to map detection and hardening measures to the attack surface.

Risk and Threat Considerations

Actively exploited file inclusion bugs matter because they are often used as a first step into deeper compromise, not just as isolated information leaks. Once an attacker can read local files, the next objective is often to harvest secrets, map the application, or pivot into adjacent systems that trust the application environment.

Failure mechanism: The flaw can let an attacker supply input that resolves to unintended local content, bypassing the application’s intended file access rules and exposing internal files or configuration data.

Impact: Exposure may include sensitive application data, credentials, or information that accelerates follow-on compromise, especially if the Metabase instance has broad network access or stores operational secrets locally.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while OWASP ASVS, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP API Security Top 10	API8 — Security Misconfiguration	The issue is an exploitable API path exposing local files through unsafe request handling.
Recommendation — Harden API request handling and block unsafe file access paths at the boundary.
OWASP ASVS	V4 — API and Web Service	The vulnerability sits in a web/API surface where input validation and access control are central.
Recommendation — Verify API inputs, route handling, and server-side access controls for file access flaws.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes prioritisation, remediation, and verification the central operational control.
Recommendation — Prioritise, remediate, and verify exploited vulnerabilities on an accelerated timeline.
NIST CSF 2.0	RS.MA-1 — Response Planning and Analysis	KEV-listed exploitation requires coordinated response, containment, and recovery planning.
Recommendation — Activate incident response playbooks when a vulnerability is confirmed exploited in the wild.
MITRE ATT&CK	T1210 — Exploitation of Remote Services	The question is about real-world exploitation of an application-facing vulnerability path.
Recommendation — Map observed exploitation activity to attacker technique coverage and hunt for follow-on access.

Practitioner Guidance

What to prioritise: Treat confirmed exploitation as a containment and exposure question first, not a patching question alone. If the instance is internet-facing or handles sensitive data, prioritise isolation, access restriction, and credential review before you rely on routine change windows.

What to verify: Validate whether the vulnerable API path was reachable before remediation and whether there are signs of suspicious file-read attempts, error spikes, or unexpected requests around the custom map feature. If the application or its adjacent services used local secrets, rotate anything that could plausibly have been exposed.

Practitioner takeaway: Once a flaw enters KEV, the key decision is whether you can still assume the application’s local files were private. If you cannot make that assumption with evidence, reduce access and assess compromise before you consider the issue “just a patch.”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org