Metabase Zero-Day Allows Admin Access Without Auth
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Metabase disclosed a zero-day vulnerability (CVSS 10.0, no CVE assigned) in versions 1.58 and above that lets unauthenticated remote attackers inject arbitrary SQL into the Metabase application database and gain administrator access, then change configs, steal stored database credentials, and export data.
- The flaw affects six self-hosted release branches — x.58, x.59, x.60, x.61, x.62, and x.63 — with patches shipped in x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5; Metabase Cloud instances have already been updated.
- Metabase CEO Sameer Al-Sakran shared indicators of compromise: a POST to "/api/session/reset_password" returning HTTP 400, immediately followed by a GET to "/api/user/current" returning HTTP 200, and warned that finding this pattern in logs likely signals compromise.
- As a temporary workaround, users are urged to block the "/api/session/reset_password" endpoint; after patching, they must revoke all sessions in the core_session table, review API keys, audit admin accounts, rotate connected-database credentials, and check data warehouse logs for unauthorized access.
- Framework, the PC maker, confirmed it was breached via this exploit and notified customers that names, login IPs, addresses, phone numbers, and emails were accessed — though no order or payment information was exposed.
- This is Metabase's second severe flaw in three years: CVE-2023-38646 (CVSS 9.8) allowed pre-authenticated remote code execution on affected installations and was disclosed in mid-2023.
Why it matters: Metabase instances routinely hold credentials and query access to an organization's most sensitive data warehouses, meaning a CVSS 10.0 unauthenticated admin-takeover gives attackers the keys to every connected database. Framework's confirmed breach — with customer PII already stolen — proves the exploit is live in the wild against real companies, not just theoretical.
Ask SkimNews
