Public Exploit Details Expanded for Metabase Pre-Auth RCE CVE-2023-38646

Public reporting and proof-of-concept material further detailed exploitation of Metabase pre-auth remote code execution vulnerability CVE-2023-38646, showing how an unauthenticated attacker could abuse the product's database setup workflow to achieve code execution. Assetnote previously documented the issue as a pre-auth RCE path in Metabase, and later GitHub research described additional tradecraft around the same flaw.

The newer technical note outlined an alternative method that configured the connection as PostgreSQL while invoking the org.h2.Driver, using H2 connection-string features to trigger execution and reportedly avoid certain "database already in use" errors seen in other approaches. The write-up included example payloads using CREATE TRIGGER and INIT=RUNSCRIPT to run shell commands or fetch a remote SQL script, lowering the barrier for attackers to weaponize the vulnerability against exposed Metabase instances.