Overview

A critical security vulnerability has been disclosed in Metabase that allows an unauthenticated attacker to gain administrator access to a Metabase instance through SQL injection in the application database. Metabase has confirmed active exploitation of this vulnerability in the wild. Any self-hosted Metabase installation that exposes the /api/session/reset_password endpoint is considered vulnerable unless access to that endpoint has been explicitly blocked.

Security Advisory:
GitHub Security Advisory GHSA-vwf4-m7j8-wcjf

Metabase Security Announcement:
Security Update Available for Metabase

Affected Rosetta Environments
Most Rosetta environments are running Metabase version prior to 0.58.24 that are vulnerable.
The recommended remediation is to upgrade immediately to Metabase version 0.58.24.

Immediate Remediation

Metabase JAR can be upgraded immediately in Rosetta.

1. Stop Rosetta

On the server hosting Metabase:

dps_stop

2. Backup the Existing JAR

cd /exlibris/dps/d4_1/metabase
mv metabase.jar metabase.jar.v0.58.5.2

3. Download the Fixed Version

wget https://downloads.metabase.com/v0.58.24/metabase.jar

4. Verify Metabase version of the downloaded jar:

unzip -p metabase.jar version.properties | awk -F= '/tag/ {print $2}'

The reported version should be v0.58.24

5. Start Rosetta application components

dps_start

Alternative Remediation

In the unexpected event Metabase version cannot be upgraded, the Metabase Proxy/Load-Balancer should be reconfigured to block access to /api/session/reset_password Metabase API endpoint, for example:

Post-Upgrade Validation

After upgrading, review the Metabase environment for signs of compromise:

1. Review Administrative Configuration

Log in to the Metabase Admin UI and inspect:

• Metabase version
  Settings ("Cog" icon from the top-right of the screen) → About Metabase
  The reported version should be: v0.58.24

• Users
  Settings → Admin Settings → People
  Verify that all users are known and authorized.

• API Keys
  Settings → Admin Settings → Authentication → API Keys
  Remove any API keys that are unfamiliar or were not intentionally created.

2. Search for Exploitation Attempts

Check Metabase logs for requests to the vulnerable endpoint:

cd /exlibris/dps/d4_1/metabase/logs
grep -i "/api/session/reset_password" *

Any unexpected requests to this endpoint should be investigated as a possible compromise attempt.

3. [OPTIONAL] Revoke Active Sessions

Metabase recommends invalidating all active user sessions after upgrading Metabase version. Re-deploy of Metabase from scratch using rosetting.csh is an option how to achieve this. Follow the steps in the "How to install Metabase". 

• Article last edited: 09-AUG-2026