Metabase SQL injection via password reset endpoint

Successful exploitation can give an unauthenticated remote attacker administrator-level access to the connected Metabase instance. Because the vulnerability permits arbitrary SQL injection, the technical impact can extend to unauthorized reading or modification of application data and potentially full compromise of the application's security boundaries. Available scoring metadata rates the issue as critical with total technical impact, affecting confidentiality, integrity, and availability.

If immediate patching is not possible, reduce exposure to the vulnerable password reset functionality by restricting network access to the Metabase application, limiting access to trusted users or administrative networks, and placing the service behind compensating controls such as authenticated reverse proxies or temporary access restrictions. Monitor for suspicious use of the password reset workflow and signs of unauthorized administrative account creation or privilege changes. These measures are temporary risk reductions and do not replace upgrading to a fixed version.

Upgrade Metabase to a fixed release in the relevant branch: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5, or a later version. Organizations running affected branches should prioritize patching immediately, especially given reporting that exploitation is active and the issue is automatable.