Metabase Sounds Alarm Over Actively Exploited CVSS 10.0 Zero-Day

Summary

Metabase has disclosed a critical zero-day vulnerability that was actively exploited in the wild and carries a CVSS score of 10.0 (Critical). The flaw can be exploited remotely without authentication against an affected Metabase deployment through vulnerable password-reset functionality. By abusing the underlying SQL injection vulnerability associated with the /api/session/reset_password endpoint, an attacker can inject arbitrary SQL into the Metabase application database. Successful exploitation can allow the attacker to manipulate application data and obtain administrator-level access to the Metabase instance. The vulnerability is particularly severe because it does not require valid credentials, allowing an external attacker to target an exposed vulnerable deployment without first gaining access to a legitimate account.

Once administrator-level access is obtained, the attacker can modify Metabase application settings and potentially access credentials and connection information associated with connected databases and data warehouses. These connections can then be abused to access information that the compromised Metabase instance is authorized to retrieve, potentially resulting in the exposure and exfiltration of sensitive business or customer data. The vulnerability was discovered following suspicious activity targeting the Metabase Cloud environment, after which Metabase blocked the affected attack path, investigated the incident, and released security updates for self-hosted deployments. The active exploitation and potential access to connected data sources make this a high-priority vulnerability for organizations operating affected Metabase versions.

Vulnerability Details

CVEID/SVE ID	Severity	CVSS Score	Vulnerability Type
SVE-110167/CVE-2026-72898	Critical	10.0	SQL Injection (Unauthenticated Remote SQL Injection)

SVE: SecPod Vulnerability Enumeration.

Although a CVE identifier has not yet been published for this vulnerability, Metabase has rated the flaw CVSS 10.0 (Critical). The vulnerability can be exploited remotely without authentication and allows an attacker to inject arbitrary SQL into the Metabase application database. Successful exploitation can lead to administrator-level access, exposure of credentials associated with connected databases, unauthorized access to connected data sources, and potential exfiltration of sensitive information.

Technical Detail

The root cause of the vulnerability is an unauthenticated SQL injection flaw in Metabase's application functionality, specifically associated with the password-reset mechanism exposed through the /api/session/reset_password endpoint. The vulnerable endpoint could be reached remotely without requiring the attacker to authenticate first. By supplying specially crafted input to the vulnerable functionality, an attacker could cause Metabase to execute arbitrary SQL statements against its application database. This allowed the attacker to interact with and manipulate data maintained by the Metabase application, creating a path to bypass normal security controls and gain unauthorized access to the application. The critical nature of the flaw comes from the fact that exploitation does not require valid credentials, significantly lowering the barrier for remote attackers to compromise exposed Metabase instances.

The vulnerability can be exploited remotely without authentication against an affected Metabase deployment. An attacker can interact with the vulnerable password-reset functionality associated with /api/session/reset_password and exploit the underlying SQL injection flaw to inject arbitrary SQL into the Metabase application database. Successful exploitation can allow the attacker to manipulate application data and gain administrator-level access.

Once the attacker gains control over the application database and obtains administrator-level access, the compromise can extend beyond the Metabase application itself. Administrative access can allow an attacker to modify Metabase configuration and interact with credentials and connection information associated with external databases and data warehouses. Because Metabase acts as an intermediary between users and multiple data sources, these connected systems can become potential targets after the Metabase instance is compromised. An attacker could use the available database connections to access information that the Metabase instance is authorized to retrieve, potentially resulting in unauthorized data access and exfiltration. These credentials and database connections can therefore be abused to access information stored in connected data sources and export sensitive information.

Metabase identified a suspicious request pattern that can help organizations detect potential exploitation. In particular, a POST /api/session/reset_password request returning HTTP 400, followed by a GET /api/user/current request returning HTTP 200, may indicate that the instance has been compromised.

Affected Versions

Metabase Version Branch	Affected Versions
Metabase x.58.0	x.58.0 through x.58.22
Metabase x.59.0	x.59.0 through x.59.19
Metabase x.60.0	x.60.0 through x.60.15
Metabase x.61.0	x.61.0 through x.61.9
Metabase x.62.0	x.62.0 through x.62.7
Metabase x.63.0	x.63.0 through x.63.2

Note: In the version notation, x represents the Metabase edition. x = 0 denotes the Metabase Open Source Edition, while x = 1 denotes the Metabase Enterprise Edition.

The vulnerability is fixed in Metabase versions x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5. Versions outside the affected ranges listed above are not identified as affected by this advisory. Organizations running an affected version should upgrade to the corresponding patched release as soon as possible.

Impact

Successful exploitation can provide an unauthenticated attacker with administrator-level access to the vulnerable Metabase instance, with consequences that can extend to connected databases and data warehouses.

1. 1. Unauthorized administrator-level access to the Metabase application without valid credentials
2. 2. Modification of Metabase application settings and configuration
3. 3. Access to credentials and connection information associated with connected databases
4. 4. Unauthorized access to sensitive information stored in connected databases and data warehouses
5. 5. Exfiltration of customer and business information, including names, email addresses, IP addresses, addresses, phone numbers, and company information

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access (TA0001)
T1213.006	Data from Information Repositories: Databases	Collection (TA0009)

Mitigation

1. 1. Upgrade the Metabase installation to the latest point release for the version currently in use, using the minimum safe releases provided by Metabase.
2. 2. If immediate upgrading is not possible, temporarily block the /api/session/reset_password endpoint until the installation can be patched.
3. 3. If the /api/session/reset_password endpoint was publicly accessible, revoke all active user sessions by deleting all rows from the core_session table in the Metabase Application Database.
4. 4. Review Metabase API keys and delete any unrecognized keys.
5. 5. Review administrator accounts for unexpected or unauthorized changes.
6. 6. Rotate credentials for all databases connected to the affected Metabase instance.
7. 7. Review data warehouse logs for signs of unauthorized access.
8. 8. Review Metabase activity and query history for unexpected or unauthorized activity.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.