Metabase Zero‑Day (CVSS 10.0) Exploited in the Wild, Granting Admin Access and Potential Data Exposure
What Happened — Attackers leveraged an unauthenticated SQL‑injection flaw (CVSS 10.0) in Metabase versions 1.58‑1.63 to obtain administrator rights on Metabase Cloud instances. The vulnerability allowed arbitrary SQL execution, credential theft for connected databases, and data export before the vendor could issue a patch.
Why It Matters for Compliance & Audit Readiness
- The incident illustrates a classic control‑gap: lack of continuous monitoring for critical code changes and unpatched high‑severity flaws.
- SOC 2‑aligned programs require evidence that vulnerability management controls (e.g., timely patching, automated scanning) are operating effectively.
- Continuous evidence collection and control mapping can provide the audit trail needed to demonstrate due diligence after a zero‑day event.
Who Is Affected — Organizations across all sectors that run Metabase Cloud or self‑hosted Metabase 1.58‑1.63, notably SaaS providers, data‑analytics teams, and enterprises relying on BI dashboards.
Recommended Actions
- Immediately inventory Metabase deployments and verify version numbers.
- Apply the vendor‑provided patches (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5) or upgrade to the latest release.
- For self‑hosted instances, enable web‑application firewalls and restrict database credentials to least‑privilege service accounts.
- Map this vulnerability to your SOC 2 “Vulnerability Management” and “Change Management” controls and capture remediation evidence in a continuous‑compliance repository.
Technical Notes — The flaw is an unauthenticated arbitrary‑SQL injection (no CVE ID disclosed) affecting Metabase Cloud and on‑premise installations of versions 1.58‑1.63. Exploitation allowed admin‑level access, credential harvesting, and unrestricted data export. Source: Security Affairs