Metabase SQL injection under active exploitation, patch immediately

Affected Systems

Metabase open-source business intelligence platform. Specific affected versions not disclosed in advisory. SQL injection vulnerability allows unauthorized database access.

Exploitation Status

Active exploitation confirmed in the wild. CERT.BE has issued warning based on observed attacks. No CVE assigned yet.

Business Impact

Critical risk for organizations running Metabase instances. Attackers can execute arbitrary SQL queries, potentially leading to data exfiltration, database compromise, or lateral movement. Immediate action required due to confirmed exploitation. Specific CVSS score and technical details not yet published.

Urgency

🔴 Immediate

Recommended Actions

• Identify all Metabase instances in your environment and verify current versions immediately
• Apply latest Metabase security patches as soon as available from vendor
• Review Metabase access logs for suspicious SQL query patterns or unauthorized access attempts
• Restrict network access to Metabase instances to trusted IP ranges only until patched
• Monitor database query logs for anomalous activity originating from Metabase service accounts