Metabase SQL Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 11/08/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| metabase | ≥ 0.58.0, < 0.58.24≥ 0.59.0, < 0.59.21≥ 0.60.0, < 0.60.17≥ 0.61.0, < 0.61.11≥ 0.62.0, < 0.62.9≥ 0.63.0, < 0.63.5≥ 1.58.0, < 1.58.24≥ 1.59.0, < 1.59.21≥ 1.60.0, < 1.60.17≥ 1.61.0, < 1.61.11≥ 1.62.0, < 1.62.9≥ 1.63.0, < 1.63.5 | 0.58.240.59.210.60.170.61.110.62.90.63.51.58.241.59.211.60.171.61.111.62.91.63.5 |
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free