Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

78.4

Published

2023-07-21

Status

Modified

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Coverage 1

vulnerability

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

A zero-day vulnerability in Metabase has been exploited in the wild, allowing unauthenticated attackers to gain administrator access to the application and steal data. The vulnerability affects versions 1.58 and above, a…

The Hacker News · Aug 8, 2026 Critical

CVE-2023-38646zero-daysql injectiondata breach

All articles mentioning it

Advisories and references

• packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution....
• packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Exe...
• github.com/metabase/metabase/issues/32552
• github.com/metabase/metabase/releases/tag/v0.46.6.1
• news.ycombinator.com/item?id=36812256
• metabase.com/blog/security-advisory
• packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution....
• packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Exe...
• github.com/metabase/metabase/issues/32552
• github.com/metabase/metabase/releases/tag/v0.46.6.1