Metabase Zero-Day Exploited Before Patch

Data analytics provider Metabase released urgent patches this week for a critical SQL injection vulnerability that attackers have already exploited in the wild as a zero-day. The flaw, lacking a CVE identifier, was discovered after a threat actor used it to attack Metabase Cloud, prompting the company to block the attack endpoints and quickly develop fixes. The patches cover multiple versions, but self-hosting users face a heightened risk if they delay applying them.

Critical SQL Injection Flaw

The vulnerability is a critical-severity SQL injection issue that allows remote, unauthenticated attackers to inject arbitrary SQL queries into the Metabase application database. This can lead to full administrative access, enabling attackers to change application configuration, steal stored credentials for connected databases, read any data accessible through those connections, and export data.

Zero-Day Discovery and Response

Metabase disclosed that the bug was discovered after a threat actor exploited it as a zero-day in an attack targeting Metabase Cloud. In response, the company blocked the endpoints used for the attack and then quickly identified and patched the vulnerability. Metabase Cloud instances have already been updated and patched, but self-hosting users are advised to apply the patches as soon as possible to prevent exposure.

Patched Versions and Workaround

Metabase versions 63.5, 62.9, 61.11, 60.17, 59.21, and 58.24 contain the necessary patches. For environments where patching is not immediately possible, users are advised to block the /api/session/reset_password endpoint as a temporary workaround.

Post-Patch Security Steps

If the endpoint was accessible from the internet, users should apply the patches, then revoke all active user sessions, review API keys and delete any unrecognized keys, review administrative accounts, rotate credentials for all connected databases, and review logs and Metabase activity for suspicious access.

Detecting Compromise

To identify potential compromises, users should look for a “POST /api/session/reset_password” call with a ‘400’ status code followed by a “GET /api/user/current” call with a ‘200’ status code. Metabase warns that this pattern in application logs or server ingress logs indicates a likely compromise.

Why It Matters

For self-hosted Metabase deployments, this incident underscores the urgency of applying security patches promptly, particularly when a vulnerability is known to be exploited in the wild. The attack chain—from SQL injection to full administrative control—can expose sensitive data and credentials, making it critical for organizations to follow the recommended remediation steps. This could also signal a broader trend of attackers targeting analytics platforms, which often hold valuable data and trusted connections.