Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackGHSA-vwf4-m7j8-wcjf
By Yogev Levi |
10 August 2026
Metabase reset_password endpoint exploit enables SQL injection and admin takeover
Metabase >=0.58.0 is exploited via POST /api/session/reset_password to inject arbitrary SQL into the Metabase application DB, yielding admin access. Attackers can change config, steal stored DB credentials, read/export connected data, and create/abuse API keys. Upgrade to 0.58.24+, 0.59.21+, 0.60.17+, 0.61.11+, 0.62.9+, or 0.63.5+