A maximum-severity zero-day SQL injection vulnerability in Metabase Cloud has granted attackers remote administrator access. The breach threatens not only direct users but also an extensive network of downstream organizations.

Key Takeaways

  • Impacts Metabase Cloud versions 1.58 and above.
  • Assigned a maximum CVSS severity score of 10.
  • Allows remote attackers to gain full administrator access via SQL injection.
  • Self-hosted instances remain vulnerable if the password reset API is exposed.

A critical zero-day SQL-injection vulnerability has been discovered in Metabase Cloud, an AI-driven business analytics platform. The flaw allows malicious actors to inject SQL statements directly into the application database, effectively granting them full administrator privileges over the instance.

Metabase CEO Sameer Al-Sakran announced that the company has already patched the vulnerability for its cloud customers. However, the danger persists for those utilizing self-hosted versions of the software. Specifically, instances that have the /api/session/reset_password endpoint exposed to the public internet are currently susceptible to exploitation.

Read Also:Homey Unveils Homey Portal: A Sophisticated Touchscreen Controller for Smart Homes

Why This Matters

BozokMedia analysis shows that the "blast radius" of this attack is exceptionally wide. Because Metabase acts as a centralized hub for processing data from various SQL databases, a single compromise allows an attacker to steal stored credentials for all connected databases. This transforms a platform breach into a gateway for wider corporate espionage and data theft across multiple downstream clients.

"The persistence of SQL injection flaws in modern software is a frustrating reality, often stemming from the difficulty of implementing prepared statements across diverse database types."

The real-world consequences are already evident. n8n, a workflow automation startup, reported the theft of 136 customer records. Similarly, Kilo Code disclosed that the breach exposed customer names, emails, and even Slack access tokens, illustrating how a vulnerability in one tool can compromise an entire communication ecosystem.

User Type Risk Level Required Action
Metabase Cloud Users Low (Auto-patched) None required
Self-Hosted Users Critical Update to latest version immediately
Did You Know?: SQL injection is one of the oldest web vulnerabilities, yet it consistently remains on the OWASP Top 10 list due to improper input validation in legacy and complex systems.

Frequently Asked Questions

Q1: How do I know if my self-hosted instance is vulnerable?
If you are running version 1.58 or above and your API port (usually 3000) is accessible from the public web, you are likely at risk.

Q2: What is the immediate fix if I cannot update right now?
You should immediately block access to the /api/session/reset_password endpoint via your network firewall or proxy.