Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
CVSS Details
- CVSS 4.0 Base Score: 10 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Metabase | — | Upgrade Metabase to version 1.62.9.Upgrade Metabase to the latest versionUpgrade Metabase to version 1.58.24.Upgrade Metabase to version 1.60.17.Upgrade Metabase to version 0.63.5.Upgrade Metabase to version 1.59.21.Upgrade Metabase to version 0.61.11.Upgrade Metabase to version 0.60.17.Upgrade Metabase to version 1.63.5.Upgrade Metabase to version 1.61.11.Upgrade Metabase to version 0.58.24.Upgrade Metabase to version 0.59.21.Upgrade Metabase to version 0.62.9. | Aug 24, 2026 | Aug 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub