Metabase SQLi vulnerability puts enterprise data at risk

Zero-day in BI platform exposes credentials and API keys

A SQL injection vulnerability in Metabase, the open-source business intelligence platform, has been exploited in the wild. The flaw, rated 10/10 on the CVSS scale, allows attackers to gain raw SQL access to connected databases.

How the exploit works

The entry point is Metabase’s /api/session/reset_password endpoint. Threat actors can inject malicious SQL through this endpoint, gaining access to usernames, email addresses, cloud passwords, cryptographic hashes of OpenTelemetry API keys, Slack access tokens, and other sensitive information stored in connected data warehouses.

Scale of the threat

Scott Miserendino of DataBee says this vulnerability allows attackers to have raw SQL access to the Metabase database. The flaw also affects OEM versions of Metabase embedded in other products, meaning affected users may not even know Metabase is part of the product they purchased.

Organizations affected

Companies impacted so far include smaller organizations and startups such as Kilo Code, recently acquired by Anaconda; Tally, a Y Combinator-backed platform building autonomous accounting agents; Framework, the personal computer manufacturer; n8n, the workflow automation platform; and ChecklyHQ, an AI testing and monitoring provider.

Victim companies report that threat actors accessed records containing usernames, email addresses, cloud passwords, cryptographic hashes of OpenTelemetry API keys used for trace collection, Slack access tokens, and other sensitive information. All affected companies say they are directly contacting impacted customers and have taken mitigation actions, including rotating potentially impacted credentials and API keys, resetting all user passwords, and invalidating Slackbot authentication tokens for impacted users.

What affected customers should do

1. Upgrade to Metabase 0.58.24 or later immediately
2. If unable to upgrade quickly, block the /api/session/reset_password endpoint
3. Revoke all active user sessions and delete any unrecognized API keys
4. Audit data warehouse logs and admin accounts for unauthorized access or other unexpected changes
5. Rotate credentials for all connected databases
6. Review Metabase activity and query histories for suspicious activity

WAF and monitoring recommendations

DataBee’s CTO advised enterprises to monitor their security and database logs for the creation of new or recently elevated administrator accounts, or other unusual activity such as large volumes of data drops. Organizations wrapping a third-party REST interface should incorporate a web application firewall (WAF) or reverse proxy with SQLi detection.

Anaconda urges customers to stay alert for phishing and social engineering, and to maintain credential hygiene including regular auditing, reviewing, and rotating of credentials, and spam monitoring.

About Metabase

Metabase is an open-source BI platform that connects to popular databases including Databricks, MongoDB, Oracle, Snowflake, Amazon BigQuery, and many others. It allows customers to access analytics, query and visualize data, and build dashboards. Security company Wiz reported that around 13% of cloud environments have deployed self-hosted Metabase instances, and of those, about 25% are fully accessible on the internet.

This Metabase vulnerability shows why data infrastructure security deserves attention. eHawu’s platform is built on the principle that enterprise network security needs layered defense. Our solutions give you visibility and control over the connections your BI and analytics tools make — so if a vulnerability gets exploited, lateral movement is blocked and customer data stays protected. Learn more about eHawus enterprise security platform.