Metabase zero-day in the wild unlocks admin access with unauthenticated SQL injection
Metabase warns of a high-severity zero-day (CVSS 10) that has been exploited in the wild to gain unauthenticated admin access by injecting arbitrary SQL into the Metabase database. The flaw affects self-hosted Metabase versions from 1.58.x up to 1.63.x (fixed in 1.63.5); Metabase Cloud was updated. A temporary workaround is to block the /api/session/reset_password endpoint. After patching, admins should revoke all sessions, review and rotate API keys and credentials, verify administrator accounts, and inspect logs for unauthorized activity. IoCs include a POST /api/session/reset_password (400) followed by a GET /api/user/current (200). Affected customer Framework reported exposure of names, login IPs, addresses, phone numbers, and emails, though no payment data was compromised. Metabase did not detail the attacker activity but referenced a past vulnerability CVE-2023-38646.