If you are an active Metabase user, we have important information to share about a recent security incident.
We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability.
If you are a Metabase Cloud customer, your instance is already upgraded and patched against this vulnerability.
If you are self-hosting Metabase, your instance of Metabase may be vulnerable. After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data.
For more information, see the security advisory.
We recommend you immediately upgrade to the latest point release of the version you are running and take the following steps.
If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible then please do the following after you upgrade:
- revoke all active user sessions by accessing the Metabase Application Database and deleting all rows in the
core_sessiontable - review your API keys and delete any unrecognized keys
- review administrator accounts for any unexpected changes
- rotate credentials for any of the connected databases
- review data warehouse logs for any sign of unauthorized access
- review Metabase activity and query history for unexpected or unauthorized activity
Attack pattern
The pattern of attack looks like the following:
- call to
POST /api/session/reset_passwordwith a 400 status code followed by - call to
GET /api/user/currentwith a 200 status code
If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.
Upgrade instructions
See the list of versions below and find the latest point version for the Metabase version you’re running. If you’re running a point version below that version, you are still vulnerable and should upgrade.
For example, if you are running 0.58.6, you should upgrade to 0.58.24 release or later. If you’re running a version of Metabase below version 58, you are not vulnerable.. You can find your current version by clicking on the “gear” or “grid” icon in the upper right and selecting “About Metabase” or “Help > About Metabase”, depending on your version.
The downloads below include the minimum safe release for each Metabase version.
63
0.63.5
- Docker image:
metabase/metabase:v0.63.5 - Download the JAR here: https://downloads.metabase.com/v0.63.5/metabase.jar
62
0.62.9
- Docker image:
metabase/metabase:v0.62.9 - Download the JAR here: https://downloads.metabase.com/v0.62.9/metabase.jar
61
0.61.11
- Docker image:
metabase/metabase:v0.61.11 - Download the JAR here: https://downloads.metabase.com/v0.61.11/metabase.jar
60
0.60.17
- Docker image:
metabase/metabase:v0.60.17 - Download the JAR here: https://downloads.metabase.com/v0.60.17/metabase.jar
59
0.59.21
- Docker image:
metabase/metabase:v0.59.21 - Download the JAR here: https://downloads.metabase.com/v0.59.21/metabase.jar
58
0.58.24
- Docker image:
metabase/metabase:v0.58.24 - Download the JAR here: https://downloads.metabase.com/v0.58.24/metabase.jar
Workaround: temporarily block the affected endpoint
If you are unable to upgrade ASAP, as a temporary workaround, block the /api/session/reset_password endpoint.