Critical Metabase Zero-Day Exploited: Hackers Gain Admin Access Without Login
Metabase has issued an emergency advisory warning customers about a maximum-severity zero-day vulnerability (CVSS 10.0) in its business intelligence platform that is being actively exploited in the wild. The flaw, which currently lacks a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL queries into the Metabase application database, instantly escalating to administrator privileges without any credentials. From there, attackers can manipulate application configuration, harvest stored credentials for connected databases, exfiltrate any data accessible through those connections, and export sensitive records.
The vulnerability affects all Metabase installations running version 1.58 and above, including the 1.58.x, 1.59.x, 1.60.x, 1.61.x, 1.62.x, and 1.63.x release branches. Patched versions are now available—x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5—and Metabase Cloud instances have already been updated automatically. Self-hosted administrators are urged to apply the patches immediately. As an interim workaround, security teams should block the "/api/session/reset_password" endpoint at the network layer until upgrades can be deployed. After patching, organizations should review their attack surface with a port scanner to verify the endpoint is no longer publicly accessible.
Metabase CEO Sameer Al-Sakran shared specific indicators of compromise: a POST request to "/api/session/reset_password" returning a 400 status code, followed shortly by a GET to "/api/user/current" returning 200. Organizations that detect this pattern in their application or ingress logs should treat their instance as compromised and take immediate remediation steps—revoking all sessions in the Metabase application database, auditing API keys, reviewing administrator accounts, rotating database credentials using a trusted password checker to ensure new keys meet strength requirements, and inspecting data warehouse logs and query history for unauthorized activity.
Among the confirmed victims is laptop manufacturer Framework, which disclosed that attackers accessed customer names, billing and shipping addresses, phone numbers, and email addresses during the incident, though no order or payment data was compromised. Affected users should verify their exposure by running their email through the email breach checker and remain alert for targeted phishing attempts leveraging the stolen information. The incident echoes a similar "extremely severe" Metabase flaw from 2023 (CVE-2023-38646, CVSS 9.8) that enabled pre-authenticated remote code execution, underscoring a recurring pattern of critical security issues in the platform that demand prompt patching.