Metabase Admins Must Patch Critical 10/10 Vulnerability Now

What’s Happening Right Now

Developers have detailed the ongoing attacks in recent security disclosures. Attackers are exploiting the /api/session/reset_password endpoint to inject malicious SQL code directly into vulnerable instances. Once inside, they escalate privileges to gain full administrator access, giving them complete control over the compromised system.

This isn’t theoretical. Attacks are happening now. Metabase instances exposed on the internet are actively being targeted.

Who Is Affected

Your instance is vulnerable if the /api/session/reset_password endpoint is publicly accessible. This single access point is all an attacker needs to gain entry. If you cannot patch immediately, you must disable this endpoint to block ongoing exploitation attempts.

How to Fix This

Patching alone is not enough. You need to take three steps:

1. Upgrade to a patched version. Secure versions include 0.58.2, 0.59.2, 0.60.1, 0.61.1, 0.62.9, and 0.63.5. All previous versions are considered vulnerable.
2. Revoke all active sessions. Any current user sessions must be terminated to remove attacker access.
3. Rotate all credentials. Change database credentials and API keys for affected instances immediately.

This three-step process ensures that even if attackers had access before the patch, they lose it afterward.

The CVE Gap

No CVE number has been assigned yet despite the severity. This creates a visibility problem. Without a CVE identifier, automated vulnerability scanners won’t flag your instances, and broader security teams may miss the alert entirely. Metabase users need to act on the raw technical details rather than waiting for official CVE tracking.

Timeline

Attacks began before patches were available. The window between active exploitation and public disclosure was narrow. If your instance was exposed during that period, assume compromise and follow the three remediation steps above regardless.

Monitor Metabase security announcements closely. Until a CVE is assigned, the responsibility for awareness falls on administrators reading security blogs and vendor communications, not automated tools.