This Metabase Zero-Day Exposes Your Entire Database

A CVSS ten point zero zero-day is exposing your Metabase databases right now. If you're running an unpatched instance, your entire data infrastructure could be compromised. And attackers don't even need to guess a single password. To all security teams, database administrators, and DevOps engineers: we've got an active emergency. Metabase has a critical vulnerability. And it's being actively targeted. This flaw lets completely unauthenticated attackers bypass the standard password reset endpoint. It exploits a severe SQL injection vulnerability. With this, an external actor can leak your sensitive database credentials, access your proprietary data, and potentially execute remote commands. Which, let's be honest, is a total nightmare. Since this exploit needs zero authentication, any exposed Metabase instance is a sitting duck. Let's break down exactly how this bypass occurs. We'll also cover how to hunt for indicators of compromise in your logs, and the immediate steps you must take to patch it. First, the core of the exploit relies on the validation flow. During a password reset request, the application fails to properly sanitize input before passing it to the database query handler. An attacker sends a specifically crafted payload to this unauthenticated endpoint. This injects malicious SQL commands that force the application to retrieve and output database credentials. Second, audit your Metabase logs immediately for SQL injection attempts. Check your application server logs for unusual POST requests targeting the password reset validation paths. Watch out for strings containing database-specific functions, unexpected syntax blocks, or suspicious payloads. Pay close attention to unexpected traffic spikes on these endpoints originating from unfamiliar external IP addresses. Third, mitigate the threat immediately by patching. The only permanent fix is upgrading your Metabase instance to the latest secure release. If you can't patch immediately, lock down your network configuration. Pull the Metabase interface behind a secure virtual private network. Restrict access using web application firewall rules, and temporarily disable public access to the application. Don't wait for an automated scanner to find your server. Pause what you're doing. Verify your Metabase version, and audit your access logs right now. Share this alert with your engineering teams to keep your infrastructure secure. And follow for more critical security breakdowns.