Metabase warns of zero-day SQL injection with CVSS 10.0 score exploited in data theft
This digest was compiled by AI from multiple sources — links to the originals are below.
Metabase discloses a critical zero-day vulnerability in its business intelligence platform actively exploited to steal customer data. The flaw, an unauthenticated SQL injection with a CVSS score of 10.0, allows remote attackers to gain administrator access and exfiltrate information. Metabase has patched the vulnerability, but self-hosted instances remain at risk unless manually updated.
The Vulnerability
Metabase confirmed the flaw is an unauthenticated SQL injection that can provide remote attackers with administrator access to customer instances. The vulnerability carries a CVSS score of 10.0, reflecting its critical severity. All Metabase versions from 0.58 onwards are affected, CEO Sameer Al-Sakran warned in a blog post. Once inside, an attacker can modify application settings, steal stored database credentials, and read or export any accessible data.
Active Exploitation
Metabase Cloud SaaS infrastructure was compromised through the zero-day before patches were automatically deployed. The attacks targeted customer instances, with confirmed victims including Framework and Tally. Exploitation involved a crafted POST request to '/api/session/reset_password' returning a 400 status, followed by a successful GET to '/api/user/current'. Metabase immediately blocked the attack endpoints and upgraded all cloud environments.
Patches and Mitigation
Metabase released fixes for all affected branches: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Self-hosted customers must manually apply these updates to close the attack vector. As a temporary workaround, blocking access to the '/api/session/reset_password' endpoint is advised. Metabase also recommends revoking active user sessions, reviewing administrator accounts and API keys, rotating database credentials, and inspecting logs for anomalous query histories.
What's Next
Metabase investigates the full extent of data exfiltration and may release additional indicators of compromise. It remains unclear how many self-hosted instances were breached before the patch, and whether threat actors will target unpatched systems.
2 sources
Metabase warns of zero-day SQL injection with CVSS 10.0 score exploited in data theft
