Metabase confirms attacks on an unauthenticated SQL injection
Metabase says attackers used an unknown vulnerability in versions 1.58 and above to compromise Metabase Cloud and that self-hosted deployments are also affected. The issue is an unauthenticated SQL injection flaw that can give a remote attacker administrator access to a customer's instance.
Metabase often connects straight to operational and business databases. An attacker with admin rights can get at the stored credentials for those connections and the data behind them.
Exploited, no login needed, admin at the end
Metabase has confirmed active exploitation. The flaw needs no login. A successful attacker ends up as an administrator on a platform that often sees a lot of company data.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The attack starts remotely and can end with access to application configuration, stored credentials and data exports.
Configuration, database credentials and exports
Metabase's advisory says the flaw can let an attacker inject arbitrary SQL into the application's database and from there obtain administrator access. With that access, the vendor says the attacker could change application configuration, steal stored credentials for connected databases, read any data accessible through those connections, and export data.
BleepingComputer reports that Framework and Tally have both disclosed downstream impact. LexisNexis also warned customers about disruption tied to affected third-party systems while its investigation continued.
Patch self-hosted instances and check reset_password requests
Metabase says Cloud customers have already been patched. Self-hosted customers have to upgrade themselves. Start by finding every instance on an affected version and checking whether it can be reached from untrusted networks or through trusted internal paths.
- Upgrade self-hosted Metabase immediately to a fixed release on your affected branch, or block the
/api/session/reset_passwordendpoint until patching is complete if you absolutely cannot move right away. - Revoke active user sessions, review administrator accounts and API keys, and rotate credentials for connected databases. The patch alone does not finish the job.
- Inspect logs and query history for the attack pattern Metabase described: a POST to
/api/session/reset_passwordreturning400, followed by a successful GET to/api/user/current. - For each Metabase deployment, list the connected systems and credentials that could have been exposed through it.
- Brief internal owners early if customer analytics, product telemetry, or internal reporting environments rely on Metabase and could create downstream business-impact questions.
Map what your analytics stack can reach
Analytics platforms collect data, credentials and admin access over time, so a compromise there can expose far more than the application itself.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
If you haven't mapped which data stores, service accounts and teams depend on that stack, an incident like this will show the gap before the patch window closes.
Sources
Primary sources: BleepingComputer's reporting and the Metabase advisory it links to.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
