Critical Metabase SQL Injection Zero-Day Exploited in Data Theft Attacks

A critical SQL injection vulnerability in open-source business intelligence tool Metabase has been actively exploited as a zero-day flaw, allowing unauthorized attackers to breach customer database instances and steal sensitive data. Security researchers and affected companies have confirmed that the flaw affects self-hosted deployments of the software, enabling remote code execution and direct access to connected corporate databases without requiring authentication.

According to security advisories and corporate disclosures, the vulnerability impacts Metabase versions prior to 0.46.6.1 and 1.46.6.1. The flaw centers around an improper neutralization of special elements used in a SQL command, a classic injection vector that malicious actors leveraged in the wild before an official patch became available in July 2023.

Companies including hardware manufacturer Framework and expense management platform Tally have publicly reported security incidents tied to the Metabase zero-day exploitation. Technical analyses published across the cybersecurity community detail how threat actors scanned the internet for exposed Metabase instances, extracted setup tokens, and generated administrative credentials to execute arbitrary queries against backend databases.

Understanding the Metabase SQL Injection Vector

The security flaw, tracked as CVE-2023-38646, stems from a setup endpoint in Metabase that failed to properly validate user-supplied input. Attackers exploited this weakness by sending specially crafted requests to unauthenticated setup endpoints, tricking the application into exposing internal database connection strings and configuration details.

Once attackers obtained these credentials, they could execute arbitrary database queries, exposing customer records, internal business documents, and credentials stored within connected data warehouses. Because Metabase typically connects to primary production databases or data lakes to build business intelligence dashboards, a successful compromise of the platform often grants broad read access to an organization’s most critical data repositories.

Security firms noted that the barrier to entry for exploiting CVE-2023-38646 was exceptionally low. Automated scanner scripts quickly appeared on underground forums following the initial disclosure, allowing even low-skilled attackers to identify vulnerable endpoints and exfiltrate data from unpatched servers.

Impact on Enterprise Customers and Response

Modular laptop maker Framework disclosed in July 2023 that an unauthorized party accessed a subset of its customer data by exploiting the Metabase vulnerability. According to Framework’s public incident report, the exposed database contained limited customer information, but the breach prompted an immediate internal security review and infrastructure isolation.

Similarly, corporate expense management firm Tally experienced unauthorized data access stemming from the same zero-day attack vector. Affected organizations have scrambled to invalidate compromised database credentials, rotate API keys, and audit access logs to determine the full scope of data exfiltration.

Metabase released emergency patches—versions 0.46.6.1, 0.45.4.1, 0.44.7.1, and 0.43.7.1—urging all self-hosted administrators to upgrade immediately. For administrators unable to patch right away, security teams recommended implementing temporary web application firewall rules or blocking external access to the vulnerable setup endpoints.

Mitigation and Verification Steps for Administrators

Securing an affected Metabase instance requires more than simply applying the software update. Because the vulnerability allowed attackers to create administrative accounts and generate session tokens, administrators must thoroughly check their user directories for unknown accounts or suspicious administrative activity.

Security agencies recommend taking the following remediation steps for any self-hosted Metabase deployment:

• Upgrade the Metabase application to version 0.46.6.1 (or the respective patched version for older release trains) immediately.
• Review the list of users and administrators within the Metabase dashboard to identify any unauthorized or recently created accounts.
• Rotate all database passwords, API keys, and service account credentials that were accessible via the Metabase instance.
• Examine web server and application logs for suspicious requests directed at the /api/setup endpoints prior to patching.

Organizations should also review their network segmentation policies to ensure that business intelligence tools do not maintain direct, unmonitored access to sensitive production databases.

As organizations continue to audit their exposures, enterprise security teams await further technical advisories from software maintainers regarding zero-day detection methods. System administrators should monitor the official Metabase repository and security mailing lists for ongoing patch updates and hardening guidelines.