Metabase zero-day (CVSS 10.0) exploited for unauthenticated admin access

Affected Systems

Metabase versions 1.58.0 through 1.63.2 (all self-hosted and cloud instances). Specifically: 1.58.0–1.58.23, 1.59.0–1.59.20, 1.60.0–1.60.16, 1.61.0–1.61.10, 1.62.0–1.62.8, and 1.63.0–1.63.2. Metabase Cloud instances already patched.

Exploitation Status

Actively exploited in the wild as a zero-day. Metabase Cloud was attacked. Framework (PC maker) confirmed breach with customer data accessed. No CVE assigned yet.

Business Impact

Unauthenticated attackers can inject SQL into the Metabase application database via the /api/session/reset_password endpoint, gaining full admin access. This enables configuration changes, credential theft for connected databases, data exfiltration, and unauthorized queries. Framework breach exposed customer names, IPs, addresses, phone numbers, and emails. Organizations using Metabase for BI/analytics face immediate risk of database compromise and data theft.

Urgency

🔴 Immediate

Recommended Actions

• Update self-hosted Metabase immediately to patched versions: 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5
• If immediate patching is not possible, block the /api/session/reset_password endpoint at firewall or reverse proxy level
• Search application and ingress logs for POST /api/session/reset_password with 400 status followed by GET /api/user/current with 200 status as compromise indicator
• If compromise suspected: delete all rows in core_session table, review and delete unrecognized API keys, audit admin accounts for changes, and rotate all connected database credentials
• Review Metabase query history, data warehouse logs, and activity logs for unauthorized access or data exfiltration since vulnerability introduction in version 1.58.0