Metabase Setup Token Flaw Enables Unauthenticated Remote Code Execution

Metabase disclosed CVE-2023-38646, a pre-authentication remote-code-execution flaw that lets unauthenticated attackers retrieve an exposed instance setup token and submit it to the /api/setup/validate endpoint. A malicious H2 JDBC connection string can exploit unsafe database-connection validation and trigger code execution on the Metabase host, potentially giving an attacker operating-system command execution.

The exposure resulted from a 2022 refactoring change that stopped deleting the setup token after initial configuration on affected deployments. Metabase Open Source versions before 0.46.6.1 and Enterprise versions before 1.46.6.1 were affected; Metabase issued an immediate upgrade advisory and released fixes. Internet-facing instances were particularly exposed—researchers estimated roughly 20,000 reachable systems—and a successful compromise could also provide access to data sources connected through Metabase.