Zero-Day Exploitation: Unauthenticated Metabase SQL Injection CVSS 10 Flaw
Executive Summary
A critical zero-day vulnerability in Metabase (CVSS 10.0) has been actively exploited in the wild, leading to unauthorized database compromises and customer data theft. The flaw impacts Metabase versions 1.58 and above across both self-hosted installations and Metabase Cloud environments. Unauthenticated remote threat actors exploited the vulnerability to inject arbitrary SQL statements into the backend database, granting full administrative control, enabling configuration tampering, and allowing bulk exfiltration of sensitive connected database credentials and stored customer records.
Technical Analysis
The following table summarizes the technical parameters of the vulnerability:
Category
Specification
Vulnerability Type
Unauthenticated SQL Injection (SQLi)
Severity Score
CVSS v3.1 / v4.0: 10.0 (Critical)
Affected Versions
Metabase 1.58.x and above (prior to emergency patch)
Primary Mechanic
Unsanitized input in an unauthenticated API endpoint
Exploitation Mechanics
The flaw resides in an unauthenticated API endpoint where user-supplied input failed to undergo proper parameterized sanitization prior to execution within Metabase's core query execution engine. By crafting malformed HTTP POST requests containing SQL injection payloads, attackers bypassed application-level authentication boundaries.
Impact & Escalation
Once SQL injection was achieved, threat actors escalated privileges to full application Administrator. With administrative access, attackers modified application settings, extracted stored plaintext and encrypted database connection strings, harvested API keys, and executed bulk database dump queries to exfiltrate proprietary customer data.
Industry Impact & Recommendations
This vulnerability primarily affects Business Intelligence (BI) consumers, SaaS platforms, tech startups, and enterprise data analytics environments. Organizations utilizing Metabase should prioritize the following mitigation directives:
* Immediate Patching: Upgrade all self-hosted Metabase instances immediately to the latest patched releases (Metabase 1.58.x emergency patch or version 1.59+).
* Credential Rotation: Assume all stored database credentials, database connection strings, and API tokens configured within compromised Metabase instances are exposed. Rotate all database user passwords and secrets immediately.
* Database Audit & Isolation: Restrict Metabase database service accounts to read-only access where possible, ensuring principles of least privilege apply to connected data warehouses.
* Log Analysis: Inspect Metabase application logs and database access logs for anomalous SQL queries, bulk SELECT operations, or unauthorized admin user creations originating from untrusted external IP addresses.