Critical Zero-Day Alert: Unauthenticated Metabase SQL Injection Exploited for Mass Data Theft
Executive Summary
A critical, maximum-severity (CVSS 10.0) zero-day vulnerability in the open-source business intelligence platform Metabase is being actively exploited in wild customer data-theft campaigns. The flaw allows unauthenticated remote attackers to execute arbitrary SQL statements against underlying databases connected to Metabase instances. Threat actors are leveraging this zero-day to dump customer records, proprietary analytics, and database administrative credentials without requiring valid login credentials or user interaction. Immediate containment and patching measures are required for all enterprise Metabase deployments.
Deep-Dive Technical Analysis
Metabase serves as a central data visualization and business intelligence gateway, connecting to multiple backend data warehouses including PostgreSQL, MySQL, Redshift, and Snowflake. The newly discovered zero-day stems from improper input validation and insufficient parameterization within an unauthenticated API endpoint responsible for servicing public dashboard embeds and metadata queries.
Vulnerability Mechanics & Exploit Vector
1. Unauthenticated Endpoint Exposure: The vulnerable API route accepts JSON-formatted parameters to construct dynamic SQL queries for dashboard rendering. The application fails to strictly sanitize user-supplied field filters before passing them to the internal query builder.
2. SQL Payload Injection: By injecting malformed JSON payloads containing stacked SQL commands and subqueries, attackers can escape the intended parameter context. This permits execution of arbitrary SQL queries with the full privileges of the database connection user configured in Metabase.
3. Database Enumeration & Exfiltration: Threat actors automate the exploitation process using custom python scripts. Once SQL injection is confirmed, automated tools systematically query database schema tables (information_schema.tables), enumerate sensitive columns, and exfiltrate raw database contents in bulk via HTTP response payloads or out-of-band DNS exfiltration.
4. Privilege Escalation: In configurations where the Metabase service account possesses elevated or administrative rights on the database server, attackers have successfully created new superuser accounts or executed database-specific extensions (such as pg_exec or xp_cmdshell) to achieve remote code execution (RCE) on the underlying host infrastructure.
Industry Impact
Because Metabase is widely deployed across tech startups, fintech platforms, and enterprise data teams to unify business metrics, the blast radius of this zero-day is exceptionally severe:
* Exfiltration of High-Value Analytics: Attackers gain direct visibility into proprietary business metrics, financial transactions, user PII, and customer behavioral datasets stored in connected data warehouses.
* Supply Chain Risks: Extracted database credentials allow threat actors to pivot directly into corporate cloud environments (AWS, GCP, Azure) hosting primary production databases.
* Widespread Automated Scanning: Threat intelligence logs indicate rapid, automated global scanning sweeping IPv4 space for exposed Metabase instances on port 3000 and /api/public/ routes.
Recommendations & Mitigations
To neutralize the risk associated with this zero-day vulnerability, security teams must execute the following remediation steps immediately:
1. Apply Vendor Hotfix: Upgrade all self-hosted Metabase instances immediately to the latest patched version issued by Metabase.
2. Restrict Public Access: Isolate Metabase instances behind a secure VPN, zero-trust network access (ZTNA) gateway, or IP allowlist. Disable unauthenticated public dashboard sharing (MB_ENABLE_PUBLIC_SHARING=false) if not strictly required.
3. Enforce Least Privilege Database Access: Ensure the database user account utilized by Metabase operates under strict read-only permissions scoped specifically to necessary analytics views, revoking DROP, ALTER, and administrative system privileges.
4. Audit Database Logs: Inspect database server query logs for anomalous SQL syntax containing UNION SELECT statements, information_schema queries, or unexpected bulk data exports originating from the Metabase host IP.