Metabase has issued an urgent security advisory warning that a critical vulnerability in its business intelligence and data visualization software is being actively exploited as a zero-day. The flaw carries a maximum CVSS score of 10.0 but has not yet been assigned a CVE identifier.

According to the company, the vulnerability allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database. Successful exploitation can lead to full administrative access to affected instances without requiring any prior authentication, effectively handing attackers the keys to the platform.

Why This Matters

Metabase is widely deployed by organizations to query, visualize, and share data pulled from internal and external databases. An attacker with SQL injection capability and administrative access could potentially read, modify, or exfiltrate sensitive business data, pivot to connected data sources, or use the compromised instance as a foothold for further network intrusion.

The lack of an authentication requirement significantly raises the risk profile, since exploitation does not depend on phishing, credential theft, or social engineering. Any internet-facing Metabase deployment could be a target.

Active Exploitation Confirmed

Metabase has confirmed that the vulnerability is already being exploited in the wild, underscoring the urgency for administrators to act quickly. The absence of a CVE identifier at this stage may complicate tracking and prioritization for organizations relying on vulnerability databases to drive patch management.

Recommendations for Defenders

  • Apply any available patches or updates from Metabase as soon as they are released.
  • Restrict public internet access to Metabase instances where possible, limiting exposure to trusted networks or VPN-only access.
  • Review application and database logs for signs of anomalous SQL queries or unauthorized administrative account creation.
  • Rotate credentials and API keys associated with Metabase instances that may have been exposed.
  • Monitor vendor advisories closely for updates, including the eventual assignment of a CVE identifier.

Security teams operating Metabase deployments, particularly those exposed to the internet, should treat this as a high-priority incident response item until further guidance and patches are confirmed available.