Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN829 _____________________________________________________________________ DATE : 10/08/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running metabase versions prior to x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5. ===================================================================== https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59 https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp _____________________________________________________________________ SQL injection using an unauthenticated endpoint leading to admin access Critical perivamsi published GHSA-vwf4-m7j8-wcjf Software metabase Affected versions >= x.58.0, < x.58.23 >= x.59.0, < x.59.20 >= x.60.0, < x.60.16 >= x.61.0, < x.61.10 >= x.62.0, < x.62.8 >= x.63.0, < x.63.3 Patched versions x.58.24 x.59.21 x.60.17 x.61.11 x.62.9 x.63.5 Description Summary This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Metabase has confirmed active exploitation of this vulnerability. Please upgrade your Metabase instance ASAP. Remediation Upgrade to a patch corresponding to your Metabase major version as soon as possible. If you are unable to upgrade ASAP, as a temporary workaround, block the /api/session/reset_password endpoint. If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible, then please do the following after you upgrade: Revoke all active user sessions by accessing the Metabase application database and deleting all rows in core_session table Review your API keys and delete any unrecognized keys. Review administrator accounts for any unexpected changes. Rotate credentials for any of the connected databases. Review data warehouse logs for any sign of unauthorized access. Review Metabase activity and query history for unexpected or unauthorized activity. Versions with the fix v63.5 OSS: jar | docker EE: jar | docker v62.9 OSS: jar·docker EE: jar·docker v61.11 OSS: jar | docker EE: jar | docker v60.17 OSS: jar | docker EE: jar | docker v59.21 OSS: jar | docker EE: jar | docker v58.24 OSS: jar | docker EE: jar | docker Severity Critical 10.0/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE ID No known CVE Weaknesses No CWEs _____________________________________________________________________ SQL injection using a publicly shared dashboard leading to admin access Critical perivamsi published GHSA-r8h2-qpfx-mx59 Software metabase Affected versions >= x.58.0, < x.58.24 >= x.59.0, < x.59.21 >= x.60.0, < x.60.17 >= x.61.0, < x.61.11 >= x.62.0, < x.62.9 >= x.63.0, < x.63.5 Patched versions x.58.24 x.59.21 x.60.17 x.61.11 x.62.9 x.63.5 Description Summary An unauthenticated attacker can inject arbitrary SQL into the Metabase application database using a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. With only the public link UUID, which is part of the shared URL by design, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Public sharing is enabled by default, so publishing a link is the only setup required. Remediation Upgrade to a patch corresponding to your Metabase major version as soon as possible. As a temporary workaround, disable public sharing, or unpublish public links that expose field-filter parameters. If you have publicly shared dashboards or cards with field-filter parameters, then please do the following after you upgrade: Revoke all active user sessions by accessing the Metabase application database and running TRUNCATE TABLE core_session. Review your API keys and delete any unrecognized keys. Review administrator accounts for any unexpected changes. Rotate credentials for any of the connected databases. Review data warehouse logs for any sign of unauthorized access. Review Metabase activity and query history for unexpected or unauthorized activity. Versions with the fix v63.5 OSS: jar | docker EE: jar | docker v62.9 OSS: jar·docker EE: jar·docker v61.11 OSS: jar | docker EE: jar | docker v60.17 OSS: jar | docker EE: jar | docker v59.21 OSS: jar | docker EE: jar | docker v58.24 OSS: jar | docker EE: jar | docker Severity Critical 9.6/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE ID No known CVE Weaknesses No CWEs _____________________________________________________________________ Leaking sensitive data from the application database to low-privilege Metabase users Moderate perivamsi published GHSA-8hmm-hrhg-ppqp Software metabase Affected versions >= x.58.0, < x.58.24 >= x.59.0, < x.59.21 >= x.60.0, < x.60.17 >= x.61.0, < x.61.11 >= x.62.0, < x.62.9 >= x.63.0, < x.63.5 Patched versions x.58.24 x.59.21 x.60.17 x.61.11 x.62.9 x.63.5 Description Summary An authenticated user with no special permissions can create a SQL question with a native query targeting the audit database, enable public sharing, run the public card and read data from the application database. The user can read the entire Metabase application database this way which contains user session records and bcrypt password hashes, amongst other sensitive information. On any instance without MB_ENCRYPTION_SECRET_KEY set (the default), the same read returns the stored credentials for every connected database in cleartext. Remediation Upgrade to the patch for your Metabase major version. As a temporary workaround, disable public sharing. After upgrading, take three steps: Review public cards and dashboards for any that target the audit database. If you run without MB_ENCRYPTION_SECRET_KEY set, rotate the credentials for every connected database. Review query and activity history for reads against the audit database. Versions with the fix v63.5 OSS: jar | docker EE: jar | docker v62.9 OSS: jar·docker EE: jar·docker v61.11 OSS: jar | docker EE: jar | docker v60.17 OSS: jar | docker EE: jar | docker v59.21 OSS: jar | docker EE: jar | docker v58.24 OSS: jar | docker EE: jar | docker Severity Moderate 6.5/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged Confidentiality High Integrity None Availability None CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE ID No known CVE Weaknesses No CWEs ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================