Metabase patches zero-day SQL injection vulnerability

Metabase released urgent patches for a critical SQL injection vulnerability that was exploited in the wild. Metabase Cloud instances have already been updated. Self-hosted users are urged to apply the vendor’s patches or use a temporary workaround until they can update.

The vulnerability was discovered after a threat actor exploited it in an attack against Metabase Cloud. The company blocked the endpoints used in the intrusion and produced fixes for affected releases. A CVE identifier has not been assigned. Patched builds are listed as versions 63.5, 62.9, 61.11, 60.17, 59.21 and 58.24.

The flaw allows remote, unauthenticated attackers to inject arbitrary SQL into the Metabase application. The advisory warned that an attacker who gains that access could obtain full administrative control, change application configuration, steal stored credentials for connected databases, read data available through those connections, and export data. The advisory stated that Metabase identified and patched the issue quickly after blocking the endpoints used in the attack.

Metabase recommends that self-hosted administrators apply the released patches as soon as possible. Where immediate patching is not feasible, the vendor advises blocking the /api/session/reset_password endpoint as a temporary workaround. After applying patches, administrators should revoke all active user sessions, remove any unrecognized API keys, inspect administrative accounts for unauthorized changes, rotate credentials used by connected databases, and review logs and Metabase activity for suspicious access.

To help detect potential compromises, Metabase pointed to a specific log pattern: a “POST /api/session/reset_password” request returning a 400 status code followed by a “GET /api/user/current” request returning 200. Finding that sequence in application or ingress logs likely indicates the instance was compromised.

Administrators unable to update immediately are advised to isolate affected instances from the internet until they can apply the patched releases and complete the cleanup and verification steps outlined in the advisory.