Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has disclosed a maximum-severity zero-day vulnerability in its business intelligence and data visualization software that is being actively exploited in the wild. The flaw, which carries a CVSS score of 10.0 and currently lacks a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, potentially granting full administrator access to the instance.

With elevated privileges, an attacker can modify application configuration, steal stored credentials for connected databases, read any data accessible through those connections, and export sensitive information. Metabase confirmed that its cloud service was targeted and has already updated all Metabase Cloud instances to patched versions. Self-hosted users are urged to apply the available security patches immediately.

The affected versions include multiple release branches: x.58.0 to x.58.23 (fixed in x.58.24), x.59.0 to x.59.19 (fixed in x.59.21), x.60.0 to x.60.15 (fixed in x.60.17), x.61.0 to x.61.9 (fixed in x.61.11), x.62.0 to x.62.7 (fixed in x.62.9), and x.63.0 to x.63.2 (fixed in x.63.5). As a temporary workaround, Metabase advises blocking the “/api/session/reset_password” endpoint until patches are applied.

Metabase has shared indicators of compromise (IoCs) to help administrators detect potential exploitation: a POST request to “/api/session/reset_password” returning a 400 status code, followed by a GET request to “/api/user/current” returning a 200 status code. If this pattern appears in application or ingress logs, the instance is likely compromised.

One confirmed victim is Framework, a PC maker, which notified customers that names, login IPs, addresses, phone numbers, and emails were accessed during the attack. No order or payment information was exposed. This incident follows a similar critical flaw (CVE-2023-38646) that Metabase patched three years ago, which allowed pre-authenticated remote code execution.