- Published on
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
- Authors
- Name
- DeepHorus
Metabase has disclosed that a maximum-severity zero-day vulnerability in its business intelligence platform is being actively exploited in the wild, allowing unauthenticated attackers to gain administrator access. The flaw carries a CVSS score of 10.0 and does not yet have a CVE identifier. Metabase said its cloud service was attacked by someone utilizing this unknown vulnerability in versions 1.58 and above.
The vulnerability enables arbitrary SQL injection into the Metabase application database, which can be exploited to bypass authentication and obtain admin privileges. With such access, attackers can alter configuration, steal stored database credentials, read or export sensitive data, and pivot to connected systems. Metabase issued an advisory after discovering the attacks on its own cloud infrastructure.
The affected versions span multiple release trains, including x.58.0 through x.58.23, x.59.0 through x.59.19, x.60.0 through x.60.15, x.61.0 through x.61.9, x.62.0 through x.62.7, and x.63.0 through x.63.2. Patches are available, with fixed versions x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5. Metabase Cloud instances have already been updated, but self-hosted users must apply the patches immediately.
As a temporary workaround, Metabase advises blocking the /api/session/reset_password endpoint. The company also shared indicators of compromise, including a POST call to that endpoint returning a 400 status, followed by a GET to /api/user/current with a 200. CEO Sameer Al-Sakran warned that instances showing this log pattern are likely compromised.
One confirmed victim is Framework Computer, which notified customers that names, login IPs, addresses, phone numbers, and emails were exposed. No order or payment information was accessed, the PC maker said. The attack could have wider implications given Metabase's use for internal analytics and dashboarding across many organizations.
Metabase advised customers who had the reset_password endpoint publicly accessible to revoke all active sessions, delete unrecognized API keys, review administrator accounts, rotate connected database credentials, and check data warehouse logs for unauthorized access. The company has not yet disclosed detailed malicious activity specifics.
Self-hosted users should prioritize patching and follow the post-compromise steps. Metabase is continuing to investigate and may release additional guidance. Organizations should monitor logs for the IoCs and consider limiting access to the reset endpoint.
This is not the first severe flaw in Metabase; exactly three years ago, the company addressed CVE-2023-38646, a pre-authenticated remote code execution bug with a CVSS score of 9.8. That history underscores the importance of timely updates for BI and data visualization tools, which increasingly face sophisticated attacks. The latest zero-day serves as a stark reminder that even premier platforms can harbor critical vulnerabilities.
