Metabase Zero-Day Enables Unauthenticated Admin Control

A newly disclosed vulnerability in Metabase’s data visualization software has reached maximum severity, with a CVSS score of 10.0 and no CVE identifier assigned yet. The flaw allows an unauthenticated remote attacker to inject arbitrary SQL into the application database, enabling them to gain unrestricted admin access. This zero-day is already being used in the wild, according to recent reporting. ¹

The flaw exploits Metabase’s reliance on direct SQL execution against its underlying PostgreSQL database. Because user-supplied queries are passed directly to the database, attackers can send specially crafted requests that bypass authentication checks entirely. Once inside, they can read or modify any table, including sensitive configuration and audit logs, effectively taking over the entire instance. The absence of a CVE ID means there is currently no standardized tracking number for incident response teams. ¹

Metabase is widely deployed by enterprises for internal dashboards, analytics, and reporting. An unauthenticated attacker who gains admin rights could exfiltrate confidential corporate data. If a compromised instance feeds data into downstream services, attackers might extend their reach further.

Security specialists note that injection attacks remain common even in mature BI tools. Similar incidents have occurred before: Logi Analytics suffered a remote command‑execution flaw exploited for months prior to public disclosure in late 2024, resulting in widespread corporate espionage cases. That precedent underscores how fundamental vulnerabilities such as arbitrary SQL injection can persist despite decades of security research. Experts advise organizations using Metabase should immediately apply any available patches, verify database access controls, and monitor for anomalous query patterns. Failure to do so leaves systems exposed to full administrative takeover without user credentials.

The Metabase zero-day demonstrates the ongoing risk posed by unpatched software in widely-used platforms. While developers are working on remediation, users must treat the vulnerability as critical until an official fix is released and applied. Continuous monitoring, least privilege enforcement, and rigorous input sanitization remain essential defenses against similar future exploits.