Critical SQL Injection and Privilege Escalation Vulnerability in Metabase

Metabase contains a critical security vulnerability that allows an unauthenticated remote attacker to execute SQL injection attacks and achieve privilege escalation within the application. This flaw poses a significant risk to data confidentiality and integrity, as successful exploitation provides unauthorized access to database contents and administrative functions. Defenders should prioritize patching or restricting access to the Metabase instance until remediation is applied.

Impact

Successful exploitation results in full database compromise and unauthorized administrative control over the Metabase instance. This facilitates the extraction of sensitive information, modification of data, and persistent access to backend systems connected via the reporting tool.

Recommendation

• Immediately update Metabase instances to the latest version provided by the vendor.
• Restrict access to the Metabase interface to trusted networks only until patches are deployed.
• Review database audit logs for anomalous SQL queries originating from the Metabase service account.