SQL injection using an unauthenticated endpoint leading to admin access · Advisory · metabase/metabase · GitHub
//repos/advisories/show" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
metabase
metabase
Public
Notifications<br>You must be signed in to change notification settings
Fork<br>6.7k
Star<br>48.6k
SQL injection using an unauthenticated endpoint leading to admin access
Critical
perivamsi<br>published<br>GHSA-vwf4-m7j8-wcjf<br>Aug 6, 2026
Software
metabase
Affected versions
>= x.58.0, >= x.59.0, >= x.60.0, >= x.61.0, >= x.62.0, >= x.63.0,<br>Patched versions
x.58.24
x.59.21
x.60.17
x.61.11
x.62.9
x.63.5
Description
Summary
This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Metabase has confirmed active exploitation of this vulnerability. Please upgrade your Metabase instance ASAP.
Remediation
Upgrade to a patch corresponding to your Metabase major version as soon as possible. If you are unable to upgrade ASAP, as a temporary workaround, block the /api/session/reset_password endpoint.
If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible, then please do the following after you upgrade:
Revoke all active user sessions by accessing the Metabase application database and running TRUNCATE TABLE core_session.
Review your API keys and delete any unrecognized keys.
Review administrator accounts for any unexpected changes.
Rotate credentials for any of the connected databases.
Review data warehouse logs for any sign of unauthorized access.
Review Metabase activity and query history for unexpected or unauthorized activity.
Versions with the fix
v63.5
OSS: jar | docker
EE: jar | docker
v62.9
OSS: jar·docker
EE: jar·docker
v61.11
OSS: jar | docker
EE: jar | docker
v60.17
OSS: jar | docker
EE: jar | docker
v59.21
OSS: jar | docker
EE: jar | docker
v58.24
OSS: jar | docker
EE: jar | docker
Severity
Critical
10.0
CVSS overall score
This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10
CVSS v3 base metrics
Attack vector<br>Network
Attack complexity<br>Low
Privileges required<br>None
User interaction<br>None
Scope<br>Changed
Confidentiality<br>High
Integrity<br>High
Availability<br>High
Learn more about base metrics
CVSS v3 base metrics
Attack vector:<br>More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity:<br>More severe for the least complex attacks.
Privileges required:<br>More severe if no privileges are required.
User interaction:<br>More severe when no user interaction is required.
Scope:<br>More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality:<br>More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity:<br>More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability:<br>More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID
No known CVE
Weaknesses
No CWEs
You can’t perform that action at this time.