AIKIDO-2026-970273

metabase is vulnerable to SQL Injection

SQL InjectionGHSA-vwf4-m7j8-wcjf Published 3 days ago

100

Critical Risk

This Affects:

metabase

0.58.0 - 0.58.22

Fixed in 0.58.24

0.59.0 - 0.59.19

Fixed in 0.59.21

0.60.0 - 0.60.15

Fixed in 0.60.17

0.61.0 - 0.61.9

Fixed in 0.61.11

0.62.0 - 0.62.7

Fixed in 0.62.9

0.63.0 - 0.63.2

Fixed in 0.63.5

Are you affected? Scan for Free

TL;DR

An unauthenticated SQL injection in the /api/session/reset_password endpoint lets a remote attacker run arbitrary SQL against the Metabase application database. That can create or take over an administrator account, change instance configuration, steal stored credentials for connected databases, and read or export data those connections can reach. This issue is being exploited in the wild. The fix closes the injection in the password-reset path; after upgrading, revoke sessions, review admin accounts and API keys, and rotate credentials for connected databases if the endpoint was reachable.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and self-host Metabase with the /api/session/reset_password endpoint reachable by attackers.

Background info

metabase is vulnerable to SQL Injection in versions 0.58.0 - 0.58.22, 0.59.0 - 0.59.19, 0.60.0 - 0.60.15, 0.61.0 - 0.61.9, 0.62.0 - 0.62.7 and 0.63.0 - 0.63.2.