Executive brief
Metabase is a self-service analytics platform that allows organizations to query and visualize data from connected databases. An unauthenticated attacker can exploit publicly shared dashboards or cards to inject arbitrary SQL queries, potentially gaining full administrative access, stealing database credentials, and reading or exporting all data accessible through the system. Public sharing is enabled by default, making this a critical risk for any organization that has shared a dashboard or card link externally.
Technical details
This is a SQL injection vulnerability in Metabase's field-filter (dimension) parameter handling for publicly shared dashboards and cards. The vulnerable component fails to properly sanitize or parameterize user input when processing field-filter parameters in shared links. An unauthenticated attacker can craft a malicious URL using only the public link UUID—which is part of the shared URL by design—to inject arbitrary SQL into the Metabase application database. No authentication is required, user interaction is limited to clicking a link, and network access is sufficient to exploit this vulnerability. A successful attack allows an attacker to modify application configuration, exfiltrate database credentials, read any data accessible through connected databases, and potentially escalate to administrative privileges. Fixes are available in versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5 for their respective major version branches.
Affected products
- Metabase Metabase >=58.0 <58.24; >=59.0 <59.21; >=60.0 <60.17; >=61.0 <61.11; >=62.0 <62.9; >=63.0 <63.5
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Patches released for versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5