Critical · published August 10, 2026
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A remote attacker can exploit the '/reset_password' endpoint in Metabase to inject arbitrary SQL, making it astonishingly easy to gain admin access! 🔥 Think of it like a restaurant where the chef doesn’t check the orders - an attacker could slip in a fake dish request and suddenly be running the kitchen! The consequences are absolutely devastating: an attacker could not only access sensitive data but also modify configurations and completely control the Metabase instance. With admin access, they could steal valuable insights or launch further attacks, leaving your organization exposed!
Think of it like a restaurant where the chef doesn’t check the orders - an attacker could slip in a fake dish request and suddenly be running the kitchen! This vulnerability allows attackers to exploit the Metabase '/reset_password' endpoint by injecting harmful SQL commands, bypassing authentication altogether and escalating privileges to administrator level.
The consequences are absolutely devastating: an attacker could not only access sensitive data but also modify configurations and completely control the Metabase instance. With admin access, they could steal valuable insights or launch further attacks, leaving your organization exposed! Immediate action is crucial! Patch Metabase to the latest version where this vulnerability is addressed. Additionally, review your database access controls and ensure proper validation on endpoint inputs to prevent such injections in the future. You've got this! With these steps, you can secure your Metabase instance and protect your data. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| metabase/metabase | ≥ 0.58.0, < 0.58.24 | 0.58.24 |
| metabase/metabase | ≥ 0.59.0, < 0.59.21 | 0.59.21 |
| metabase/metabase | ≥ 0.60.0, < 0.60.17 | 0.60.17 |
| metabase/metabase | ≥ 0.61.0, < 0.61.11 | 0.61.11 |
| metabase/metabase | ≥ 0.62.0, < 0.62.9 | 0.62.9 |
| metabase/metabase | ≥ 0.63.0, < 0.63.5 | 0.63.5 |
| metabase/metabase | ≥ 1.58.0, < 1.58.24 | 1.58.24 |
| metabase/metabase | ≥ 1.59.0, < 1.59.21 | 1.59.21 |
| metabase/metabase | ≥ 1.60.0, < 1.60.17 | 1.60.17 |
| metabase/metabase | ≥ 1.61.0, < 1.61.11 | 1.61.11 |
| metabase/metabase | ≥ 1.62.0, < 1.62.9 | 1.62.9 |
| metabase/metabase | ≥ 1.63.0, < 1.63.5 | 1.63.5 |