Do Son 
TL;DR
Metabase disclosed a critical SQL injection zero-day rated CVSS 10. An unauthenticated remote attacker can gain full administrator access to an instance. Metabase confirms active exploitation in the wild. Self-hosted instances on version 1.58 and above are at risk. Patch immediately.
Why This Matters
Metabase is a popular open-source business intelligence tool. It connects directly to production databases. As a result, one compromised instance can expose a whole data estate. According to Metabase, an attacker who gains access “could change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data.”
The threat is not hypothetical. Attackers used an unknown “0-day” vulnerability against Metabase Cloud. Metabase “immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability.”
How the Attack Works
The flaw is an unauthenticated SQL injection. It sits in a public endpoint that needs no login. Through it, an attacker injects arbitrary SQL into the Metabase application database. That access then grants administrator control of the instance.
Attack Pattern
Metabase shared a detectable pattern. Watch for a call to POST /api/session/reset_password that returns a 400 status. A follow-up call to GET /api/user/current returning 200 is the red flag. This SQL injection sequence in your logs likely signals compromise.
Affected Versions
The bug affects self-hosted Metabase versions 1.58 and above. Versions below 58 are not vulnerable. Metabase Cloud instances are already patched.
Patch and Mitigation
Upgrade to the latest point release for your version now. Minimum safe releases include 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. If you cannot upgrade at once, block the /api/session/reset_password endpoint as a temporary workaround. After patching, revoke active sessions, review admin accounts, and rotate connected database credentials. See the official Metabase security update for full guidance.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
