Metabase has disclosed a critical zero-day vulnerability that has been actively exploited in the wild, raising serious concerns for organizations relying on the platform for business intelligence and data analytics.
The flaw impacts self-hosted deployments running version 0.58 and later, exposing sensitive systems to potential data breaches and unauthorized access.
According to the company, the vulnerability was first identified after attackers successfully targeted Metabase Cloud infrastructure before mitigation steps were implemented and a security patch was released.
Metabase Zero-Day Vulnerability
While Metabase has confirmed that its cloud-hosted customers have already been secured through rapid updates and endpoint protections, organizations managing their own deployments remain at significant risk until they apply the necessary patches.
The vulnerability allows attackers who gain initial access to a Metabase instance to inject arbitrary SQL queries directly into the application’s database.
This level of access effectively grants administrative control, enabling attackers to manipulate application configurations and escalate privileges within the system.
The implications of such access are severe. Once administrative control is achieved, threat actors can extract credentials stored for connected databases, access sensitive business data, and export critical information from integrated systems.
This is particularly dangerous for enterprises that use Metabase as a centralized analytics hub connected to production databases, cloud data warehouses, and other mission-critical environments.
The compromise of a single Metabase instance could therefore lead to a cascading breach across multiple data sources.
Metabase identified the root cause of the issue as being associated with the “/api/session/reset_password” endpoint, which may have been publicly exposed in vulnerable deployments.
Attackers exploited this endpoint to initiate a sequence of requests that ultimately bypassed intended security controls. Security teams are advised to review whether this endpoint was accessible from the internet and to analyze logs for signs of exploitation.
The vendor has also outlined a specific attack pattern that may indicate compromise, including a POST request to the reset password endpoint returning an HTTP 400 response, followed by a successful GET request to “/api/user/current” returning HTTP 200.
Organizations that detect this pattern in application logs, reverse proxy logs, or ingress monitoring systems should treat their environment as potentially compromised and immediately initiate incident response procedures.
This includes isolating affected systems, conducting forensic analysis, and identifying any unauthorized access or data exfiltration activities.
The urgency is heightened by the fact that attackers leveraging this vulnerability can operate with minimal visibility, making detection more challenging without proactive monitoring.
To address the issue, Metabase has released patched versions across multiple branches, including version 0.63.5 for branch 0.63, 0.62.9 for branch 0.62, and 0.58.24 for branch 0.58.
Organizations running older but affected versions must upgrade to these minimum secure releases immediately. Docker users should update to the latest “metabase/metabase” container image, while those using JAR-based deployments must replace existing application files with the patched versions.
Beyond patching, Metabase strongly recommends additional remediation steps. Administrators should revoke all active user sessions by clearing entries from the “core_session” table if the password reset endpoint was publicly accessible.
They should also audit API keys, verify administrator accounts for unauthorized modifications, and remove any suspicious credentials.
Since the vulnerability may expose stored database credentials, it is critical to rotate all associated credentials across connected systems.
Security teams should further investigate data warehouse logs, Metabase activity records, and query histories to identify unusual behavior, such as unexpected SQL queries or large-scale data exports.
This incident underscores the importance of securing analytics platforms, which often serve as gateways to highly sensitive organizational data.
As attackers continue to exploit overlooked entry points, maintaining strict access controls, timely patching, and continuous monitoring remains essential for mitigating emerging threats.
No Comment! Be the first one.