Description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-10T18:18:53.300Z",
  "pubdate": "2026-08-10T18:18:53.300Z",
  "executiveSummary": "This vulnerability involves an SQL injection flaw present in the Metabase application, specifically within the database endpoint associated with the password reset functionality. The security defect allows a remote, unauthenticated threat actor to supply malicious input that is improperly sanitized or parameterized before being concatenated into backend database queries executed by the application.\nThe primary impact of this vulnerability is the complete compromise of the underlying data store and the connected Metabase instance. By successfully injecting arbitrary SQL commands, an attacker can manipulate query logic to bypass authentication mechanisms, extract sensitive information, or escalate privileges within the application context.\nAffected systems include instances of Metabase that expose the vulnerable password reset mechanism over the network. The risk implications are severe, as exploitation requires no prior authentication or administrative privileges, lowering the barrier to entry for external adversaries.\nAttacker capabilities include unauthenticated remote code execution or administrative takeover via database manipulation. Exploitation requirements are minimal, relying solely on network accessibility to the targeted Metabase endpoint and the ability to interact with the '/reset_password' functionality using crafted HTTP requests containing malicious SQL payloads.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and a lack of parameterized queries or prepared statements within the '/reset_password' database endpoint in Metabase. When a user or attacker submits data through this specific function, the application fails to adequately neutralize meta-characters or enforce strict type checking, allowing user-supplied strings to directly influence the structure of the SQL commands executed against the backend database.\nThe vulnerable component is the password reset handling module exposed via the application routing layer. The network exposure is remote, as the endpoint is accessible over standard HTTP/HTTPS protocols without requiring pre-existing sessions, authentication credentials, or specific privilege levels.\nThe attack flow proceeds in a sequential manner. First, the unauthenticated attacker identifies the target Metabase instance and isolates the '/reset_password' endpoint. Next, the attacker crafts a specialized HTTP request containing a malicious SQL injection payload designed to interact with the database tables governing user accounts, session tokens, or administrative flags. Upon receiving the request, the vulnerable endpoint processes the input and embeds the payload directly into the database query without proper sanitization.\nAs the database engine parses and executes the tainted query, the injected SQL commands alter the intended application logic. This payload behavior allows the adversary to perform unauthorized database operations, such as extracting password hashes, modifying user records, or creating new administrative accounts. Through these manipulated database states, the attacker achieves complete administrative access to the connected Metabase instance, facilitating full post-exploitation control over connected data sources, internal configurations, and administrative functionalities."
}