Executive brief
Metabase is an open-source analytics and data visualization platform. An authenticated low-privilege user can read the entire application database—including user session records, password hashes, and database credentials stored in plaintext—by creating a SQL query that targets the audit database and enabling public sharing. This exposes sensitive operational data and credentials for connected databases.
Technical details
A low-privilege authenticated user can exploit insufficient access controls by creating a native SQL question that targets the audit database, enabling public sharing, and then accessing the data through the public card endpoint. The vulnerability lies in the lack of proper authorization checks on the audit database queries; the system fails to prevent low-privilege users from querying administrative schema. An attacker needs only valid authentication credentials and access to the Metabase interface (network reachable). The impact includes reading the entire application database, extracting user session tokens, bcrypt password hashes, and—on instances without MB_ENCRYPTION_SECRET_KEY set (the default configuration)—database credentials in plaintext. Patches are available in versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5.
Affected products
- Metabase Metabase 58.0 to 63.4 (specific ranges: >=58.0 <58.24, >=59.0 <59.21, >=60.0 <60.17, >=61.0 <61.11, >=62.0 <62.9, >=63.0 <63.5)
Timeline
- 2026-08-06: disclosed: GitHub Security Advisory GHSA-8hmm-hrhg-ppqp published
- 2026-08-10: patched: Patches released: v58.24, v59.21, v60.17, v61.11, v62.9, v63.5