Loading story…
Public reporting and proof-of-concept material further detailed exploitation of Metabase pre-auth remote code execution vulnerability CVE-2023-38646, showing how an unauthenticated attacker could abuse the product's database setup workflow to achieve code execution. Assetnote previously documented the issue as a pre-auth RCE path in Metabase, and later GitHub research described additional tradecraft around the same flaw.
The newer technical note outlined an alternative method that configured the connection as PostgreSQL while invoking the org.h2.Driver, using H2 connection-string features to trigger execution and reportedly avoid certain "database already in use" errors seen in other approaches. The write-up included example payloads using CREATE TRIGGER and INIT=RUNSCRIPT to run shell commands or fetch a remote SQL script, lowering the barrier for attackers to weaponize the vulnerability against exposed Metabase instances.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published a technical note describing an alternative exploitation variation for CVE-2023-38646 in Metabase, using the H2 driver while presenting the engine as PostgreSQL to avoid "database already in use" errors. The note included example payloads using H2 connection string features such as CREATE TRIGGER and INIT=RUNSCRIPT to achieve code execution.
Assetnote published a public blog post detailing a pre-auth remote code execution vulnerability in Metabase, referenced as CVE-2023-38646. This established public technical disclosure of the issue and exploitation approach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Metabase disclosed **CVE-2026-59827**, a critical unsafe deserialization vulnerability that can lead to remote code execution on the Metabase server when instances use an H2 database connection, including the default sample database. The flaw allows an authenticated user with permission to run native H2 queries to return query result columns of type `OTHER`, causing Metabase to deserialize arbitrary Java objects. The issue carries a **CVSS 9.9** rating and affects versions `1.58.0` through before `1.58.15`, `1.59.0` through before `1.59.12`, `1.60.0` through before `1.60.6.3`, and `1.61.0` through before `1.61.1.4`. A related Metabase code change in the H2 database driver shows the remediation path: the application now checks JDBC result metadata and rejects columns typed as `JAVA_OBJECT` instead of attempting to parse them. That defensive change blocks unsafe handling of serialized Java objects in H2 query results and aligns with the vendor fixes released in versions `1.58.15`, `1.59.12`, `1.60.6.3`, and `1.61.1.4`.
Jul 10, 2026
Metabase disclosed and patched multiple critical vulnerabilities after a zero-day was exploited against **Metabase Cloud**, prompting urgent warnings for organizations running self-hosted instances. The flaws include two unauthenticated SQL injection issues, `CVE-2026-72898` and `CVE-2026-72899`, and a missing authorization vulnerability, `CVE-2026-72900`. According to the advisories, `CVE-2026-72898` can be abused through the `/reset_password` database endpoint to obtain administrator-level access, and both SQL injection bugs are reported as actively exploited. Metabase said its cloud service was patched for customers, while national cybersecurity authorities urged self-hosted users to update immediately. Affected releases earlier than **63.5, 62.9, 61.11, 60.17, 59.21, and 58.24** should be upgraded to those fixed versions or later across the supported `0.58.x` to `0.63.x` branches. The notices emphasize prompt remediation because the vulnerabilities allow remote, unauthenticated compromise of exposed Metabase deployments.
Aug 12, 2026
Metabase issued an urgent security update after detecting active attacks against the `POST /api/session/reset_password` endpoint, with related requests also observed to `/api/user/current` and affected sessions tied to the `core_session` component. The flaw, tracked as **CVE-2026-72898**, is a critical SQL injection vulnerability in the password reset functionality that can expose internet-facing Metabase instances to compromise. Metabase released patched minimum safe versions across supported branches: **v0.63.5**, **v0.62.9**, **v0.61.11**, **v0.60.17**, **v0.59.21**, and **v0.58.24**. Public detection logic was also added to ProjectDiscovery's Nuclei templates, which checks `/api/session/properties` to identify vulnerable versions, including `0.63.0` through versions earlier than `0.63.5`; until upgrades are completed, Metabase advised defenders to block access to the `/api/session/reset_password` endpoint as a temporary mitigation.
Aug 12, 2026