Metabase has warned of a severe security flaw impacting its business intelligence and data visualization software package, which has been exploited as a zero-day attack. The vulnerability, identified but without a CVE identifier, allows unauthenticated remote attackers to inject arbitrary SQL into the Metabase application database, enabling them to gain administrator access to the instance. Metabase Cloud instances have been upgraded to the latest version.
The following versions are impacted: >= 1.58.0, < 1.58.23 (Fixed in 1.58.24) >= 1.59.0, < 1.59.20 (Fixed in 1.59.21) >= 1.60.0, < 1.60.16 (Fixed in 1.60.17) >= 1.61.0, < 1.61.10 (Fixed in 1.61.11) >= 1.62.0, < 1.62.8 (Fixed in 1.62.9) >= 1.63.0, < 1.63.3 (Fixed in 1.63.5) As a temporary fix until the updates can be implemented, block the "/api/session/reset_password" endpoint. Review API keys and delete any unrecognized ones; check administrator accounts for unexpected changes; rotate credentials for connected databases; review data warehouse logs for unauthorized access signs; examine Metabase activity and query history for unusual or unauthorized behavior.
