Metabase zero-day steals database passwords
Metabase Cloud's zero-day flaw lets attackers steal database passwords from self-hosted versions 1.58 and later. The company patched it after attackers exploited it.
- Severity
- Not scoredNo CVSS score recorded
- Fix
- Not confirmed
- Affects
- Metabase Cloud
- Exploited
- Not confirmedNo confirmation recorded
How it works
Attackers send a specially crafted request to Metabase's database connection settings, tricking it into leaking stored database passwords.
What to do
Check whether the installed Metabase Cloud version is older than the fixed version in the vendor advisory or current release.
Update to outdated Metabase versions immediately, as it fixes the password-leaking flaw.
Technical details
An attacker sends a fake request to a Metabase server's password page. Metabase, thinking it's a real user, shows the attacker the database password it uses to connect to your data. The attacker then uses that password to access your database directly.
A critical zero-day vulnerability in Metabase (tracked as NEWS-39a828237b55175ea7) affects self-hosted deployments running versions 1.58 and later. The flaw allows attackers to steal database credentials by exploiting an unpatched endpoint, enabling unauthorized access to sensitive data. Metabase Cloud was targeted before the vulnerable endpoints were blocked and a patch was developed.