Metabase has patched a critical SQL injection flaw that allowed unauthenticated attackers to gain full administrative access. Self-hosted users must update immediately to prevent data theft.

Key Takeaways

  • A critical SQL injection vulnerability was exploited as a zero-day in Metabase.
  • Attackers could bypass authentication to gain full administrative privileges.
  • Immediate patching is required for self-hosted instances; Cloud versions are already updated.

Data analytics provider Metabase has issued urgent security updates to address a critical-severity SQL injection vulnerability. This flaw was discovered after threat actors actively exploited it as a zero-day attack targeting Metabase Cloud. The vulnerability allows remote, unauthenticated attackers to inject arbitrary SQL queries into the application database, effectively granting them administrative control.

According to the official advisory, an attacker with administrative access could modify application configurations, steal stored credentials for connected databases, read any accessible data, and export sensitive information. While Metabase Cloud instances have been patched automatically, users running self-hosted versions are urged to apply the updates immediately to avoid exposure.

Read Also:Critical Vulnerability Discovered in Microsoft Copilot Allowing Password Theft

Why This Matters

BozokMedia analysis shows that the exploitation of a zero-day in a data-centric tool like Metabase is particularly perilous because these platforms act as gateways to an organization's entire data warehouse. The ability to gain admin access without authentication removes the primary line of defense, turning a business intelligence tool into a potential backdoor for corporate espionage or ransomware deployment.

"The gap between vulnerability discovery and patch application is the primary playground for modern threat actors; speed of deployment is now the only viable defense."

For organizations unable to patch immediately, Metabase suggests blocking the /api/session/reset_password endpoint as a temporary mitigation. If a breach is suspected, administrators should revoke all active sessions, rotate database credentials, and audit API keys for any unrecognized entries.

Did You Know?: A 'Zero-Day' vulnerability is one that is discovered by attackers before the software vendor becomes aware of it, leaving zero days for the vendor to fix it before it's exploited.

Frequently Asked Questions

Q1: How can I tell if my Metabase instance was compromised?
Answer: Check your logs for a POST /api/session/reset_password call with a '400' status code, followed immediately by a GET /api/user/current call with a '200' status code.

Q2: Which versions contain the fix?
Answer: The patches are included in Metabase versions 63.5, 62.9, 61.11, 60.17, 59.21, and 58.24.