Metabase Zero‑Day: Critical Remote Exploit – What You Must Do Now | Antonio Pedoto
A CVSS 10.0 vulnerability in Metabase lets attackers gain admin rights without authentication. Act fast to block the attack.
Hook - A Critical Threat Is Already Active "A critical vulnerability (CVSS 10.0) in one of the world’s most popular business-intelligence tools is being exploited in the wild. An attacker can gain admin access without any authentication." If your organization relies on Metabase for dashboards, data exploration, or report sharing, this headline should make you sit up straight. The open-source BI platform-used by startups, enterprises, and SaaS providers-has been hit by a zero-day that lets an unauthenticated attacker inject arbitrary SQL into Metabase’s internal application database. The impact is a full takeover: data exfiltration, tampering of reports, and even the possibility of launching ransomware against downstream systems.
Risk Explanation Metabase’s vulnerability lives in the /api/session login endpoint. The service concatenates the supplied username and password values directly into an SQL statement without proper escaping. An attacker can send a crafted JSON payload such as: The injected clause short-circuits authentication, causing the query to return a valid user row and creating an admin session that the attacker controls. Because the query runs with the same privileges as the Metabase process, the attacker can: Create admin sessions without any credentials. Read, modify, or delete any stored Metabase data, including the credentials for the underlying source databases. Execute arbitrary OS commands if the backend database permits functions like COPY … PROGRAM (e.g., PostgreSQL), potentially compromising the host itself. The vulnerability has not yet been assigned a CVE identifier because the exploit was observed in the wild before formal disclosure. Nonetheless, the CVSS score of 10.0 signals a complete breach scenario that can be achieved remotely and without any user interaction.
3 Immediate Actions You Must Take Block the Login Endpoint at the Network Edge Deploy a firewall or WAF rule that denies external traffic to POST /api/session unless it originates from trusted internal IP ranges or VPN endpoints. If you cannot restrict the endpoint, at minimum rate-limit the path and enforce a strict Content-Type: application/json header check to reduce noise. Patch or Upgrade Metabase Immediately Apply the official Metabase 0.46.5 (or later) release, which sanitizes the login parameters and removes the injection vector. For organizations that cannot upgrade instantly, temporarily disable the public login UI and enforce SSO (SAML/OIDC) that bypasses the vulnerable endpoint. Rotate All Stored Credentials and Audit Sessions Regenerate passwords for every data source configured inside Metabase (PostgreSQL, MySQL, Snowflake, etc.). Invalidate all existing sessions by clearing the core_session table or restarting the Metabase service. Review recent audit logs for any anomalous admin activity-look for new admin users, unexpected dashboard edits, or unusual COPY commands in the backend DB.
Practical Checklist ✅ Action Details --- --- Network block Add WAF rule: if request.path == "/api/session" and request.method == "POST" then block unless srcip in trustedrange Patch Upgrade to Metabase ≥ 0.46.5; verify the version via X-Metabase-Version header Credential rotation Change all source-DB passwords; purge core_session entries Log review Search for admin session creation after the vulnerability announcement date
Why Speed Matters Because the exploit is already observed in the wild, automated scanners are likely probing the internet for exposed Metabase instances. An unpatched server can be compromised within minutes of a single malicious request. The longer the vulnerable endpoint remains reachable, the greater the chance that attackers will harvest your internal database credentials and use them to pivot deeper into your network.
What Comes Next? This summary covers the urgent defensive steps, but there is a deeper technical story to explore: how the SQL injection bypasses Metabase’s ORM layer, the specific PostgreSQL COPY … PROGRAM abuse path, and mitigation strategies for self-hosted versus SaaS-based deployments. Stay tuned for our upcoming deep-dive that walks you through the exploit chain, forensic indicators, and long-term hardening recommendations.
---
🔒 Want the complete protection guide?
The deep-dive includes: ✅ Step-by-step security checklist 🔧 Recommended free tools 📋 FAQ with expert answers 🛡️ Best practices for businesses and individuals
[→ Read the Complete Protection Guide]