Critical Unauthenticated SQL Injection in Metabase (v1.58+) Enables Data Theft from SaaS and Self‑Hosted Instances

Critical Unauthenticated SQL Injection in Metabase (v1.58+) Enables Data Theft from SaaS and Self‑Hosted Instances

What Happened — A zero‑day, unauthenticated SQL injection flaw in Metabase versions 1.58 through 0.63 allows an attacker to execute arbitrary SQL, gain administrator rights, and exfiltrate data from both Metabase Cloud and self‑hosted deployments. The vulnerability (rated CVSS 10.0) has been actively exploited against customers such as Framework and Tally, resulting in confirmed data‑theft incidents. Metabase has issued a fix and recommends immediate remediation.

Why It Matters for Compliance & Audit Readiness

• The scenario maps directly to SOC 2 CC6.1 (change management) and CC7.1 (risk mitigation) – controls that require documented patch‑management processes and evidence of timely remediation.
• Continuous‑compliance programs must capture patch‑deployment evidence and validate that vulnerable endpoints are blocked, providing a defensible audit trail.
• Demonstrating real‑time monitoring of critical application vulnerabilities aligns with the Control Mapping capability, turning a technical fix into verifiable compliance evidence.

Who Is Affected — SaaS analytics providers, self‑hosted business‑intelligence platforms, and any organization that integrates Metabase for data visualization (primarily TECH_SAAS and other data‑driven enterprises).

Recommended Actions

• Upgrade all Metabase instances to the minimum safe releases (≥ 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5).
• Temporarily block the /api/session/reset_password endpoint until patches are applied.
• Revoke all active user sessions, rotate database credentials, and audit API keys and admin accounts for unauthorized changes.
• Review logs for the POST /api/session/reset_password → 400 followed by a successful GET /api/user/current pattern.
• Document remediation steps in your change‑management system to satisfy SOC 2 evidence requirements.

Technical Notes — The flaw is an unauthenticated SQL injection (SQLi) that grants admin access, enabling credential theft and arbitrary data export. No CVE ID has been assigned; Metabase’s advisory rates it Critical with CVSS 10.0. Affected versions: 1.58 and above (branches 0.58‑0.63).

Source: BleepingComputer