Metabase has released urgent patches for a critical-severity Metabase SQL injection vulnerability. According to the company’s advisory, attackers have already exploited the flaw in the wild as a zero-day, including activity targeting Metabase Cloud instances.
The issue matters because it enables a remote, unauthenticated attacker to inject arbitrary SQL into the Metabase application’s database. From there, an intruder can escalate access and potentially exfiltrate sensitive information.
What the Metabase SQL injection vulnerability enables
In plain terms, the vulnerability allows an attacker to run attacker-controlled SQL queries against the Metabase backend database. The advisory states that the attacker may gain administrative access and then take additional actions such as:
- Changing the application configuration
- Stealing stored credentials for connected databases
- Reading data accessible through those database connections
- Exporting data
Because the attacker does not need authentication, defenders should assume that exposed or vulnerable environments may have been targeted without warning.
How Metabase responded to zero-day exploitation
Metabase reports that no CVE identifier had been assigned to the bug at the time of disclosure. The company also says it became aware of the problem after a threat actor exploited it as a zero-day while attacking Metabase Cloud.
Once the exploitation pattern was identified, Metabase blocked the endpoints used for the attack and then rapidly developed and deployed patches.
Who needs to patch and which versions are fixed
Metabase Cloud has already been updated and patched. However, organizations that self-host Metabase are advised to apply the fixes as soon as possible to reduce exposure.
Metabase lists fixed versions for environments that need upgrading. The patches are included in versions 63.5, 62.9, 61.11, 60.17, 59.21, and 58.24.
Temporary workaround if you cannot patch right away
If you cannot apply the Metabase SQL injection patches immediately, Metabase recommends a short-term mitigation: block the /api/session/reset_password endpoint.
As a rule of thumb, this mitigation is most relevant when that endpoint is reachable from the internet. If your deployment is exposed externally, blocking the endpoint may help limit the attack path while you prepare the update.
Step-by-step response checklist for suspected exposure
Metabase provides additional actions for defenders—especially when the deployment is or was accessible from outside the network. If your environment cannot be confirmed as safe, treat it as potentially compromised and proceed through the following items after patching or applying the workaround.
After applying patches
- Revoke all active user sessions to cut off ongoing access from any sessions potentially created by an attacker.
- Review API keys and delete any keys that you do not recognize.
- Review administrative accounts to confirm that only authorized users have admin privileges.
- Rotate credentials for all databases connected to Metabase.
- Review logs and Metabase activity for suspicious behavior.
Why credential rotation is important
Because the vulnerability can be used to steal stored database credentials, rotation helps remove any value an attacker gained during exploitation. Even if you upgrade quickly, leaked credentials could still be used elsewhere if they remain unchanged.
Indicators of compromise in logs
Metabase also describes a specific pattern that defenders can search for in application or ingress logs. To identify potential compromises, look for this sequence:
- A call to POST /api/session/reset_password with a ‘400’ status code
- Followed by a call to GET /api/user/current with a ‘200’ status code
If you find this pattern in your logs or in your Metabase server ingress logs, Metabase says it is likely that the instance was compromised.
Practical guidance for teams managing Metabase
If you manage analytics infrastructure, this incident is a reminder that data tools are high-value targets. The combination of database-level access and administrative capabilities means the blast radius can extend beyond Metabase itself.
Here are practical actions you can take internally to speed up response:
- Confirm your deployment type (Metabase Cloud vs. self-hosted) and map where the fix needs to land.
- Inventory your current Metabase version to verify whether you are on one of the fixed releases.
- Check exposure by reviewing whether the /api/session/reset_password endpoint was accessible from the internet.
- Prepare an audit trail by collecting relevant application logs, ingress logs, and any security monitoring outputs before making broad changes.
Even if you do not find the recommended indicator pattern, reviewing administrative activity, user sessions, and API usage can still help validate your security posture.
What to do right now
Because the flaw was exploited as a zero-day, time matters. Metabase SQL injection remediation should be treated as urgent, especially for self-hosted instances.
Start by upgrading to one of the patched versions listed by Metabase. If you cannot patch immediately, block the /api/session/reset_password endpoint as a temporary mitigation, then move quickly toward a full update.
After patching (or applying the temporary control), revoke sessions, review and remove unknown API keys, inspect admin accounts, rotate connected database credentials, and scrutinize logs for suspicious access—particularly the specific request pattern Metabase highlighted.
Conclusion
Metabase has issued urgent patches for a critical Metabase SQL injection vulnerability that was exploited in real-world zero-day attacks. Cloud tenants are already updated, but self-hosted users should patch immediately, apply the endpoint block if necessary, and verify security with session revocation, credential rotation, and targeted log review.
Taking these steps quickly can significantly reduce the risk of attacker persistence and protect the data accessible through your connected databases.
Source: https://www.securityweek.com/metabase-patches-vulnerability-exploited-as-zero-day/
