Attackers exploit critical SQL injection vulnerability to gain full administrative access to Metabase

Summary

Metabase has released urgent patches for a critical SQL injection vulnerability that allows remote, unauthenticated attackers to inject arbitrary queries into the application database. The flaw enables an attacker to obtain administrative access, change application configurations, steal credentials for connected databases, and export any data accessible through those connections.

The vulnerability was discovered following active exploitation targeting Metabase Cloud. While Metabase has already updated and patched all Cloud instances, self-hosted users remain at risk and must apply updates immediately to prevent exposure.

What happened

A threat actor exploited this zero-day vulnerability against Metabase Cloud before a patch was available. In response, Metabase blocked the specific endpoints used in the attack and developed a fix.

The defect allows an attacker to bypass authentication by injecting SQL commands directly into the application's database. Once administrative control is established, the scope of impact extends beyond the Metabase instance itself; attackers can target any data warehouse or connected database linked to the application.

Affected products and fixed versions

Metabase has released patches for several major versions. Users should upgrade to one of the following versions depending on their current deployment:

Detection opportunities

To identify if an instance has been compromised, defenders should monitor application or server ingress logs for a specific sequence of requests. A successful exploitation attempt follows this pattern:

1. A POST /api/session/reset_password call that returns a 400 status code.
2. This is immediately followed by a GET /api/user/current call that returns a 200 status code.

If this specific sequence appears in your logs, the instance has likely been compromised.

Defender guidance

If you are running a self-hosted Metabase instance, prioritize these actions:

Immediate Mitigation If an immediate upgrade is not possible, block all access to the /api/session/reset_password endpoint as a temporary workaround.

Post-Patch Remediation Once the patch is applied, perform the following steps to ensure no persistence or unauthorized access remains:

• Revoke all active user sessions by accessing the Metabase application database and deleting all rows in the core_session table.
• Review API keys and delete any unrecognized entries.
• Audit administrative accounts for unexpected changes or new users.
• Rotate credentials for every connected database to prevent attackers from using stolen credentials.
• Examine data warehouse logs and Metast activity/query history for unauthorized access or suspicious patterns.