A critical SQL injection vulnerability in Metabase allows unauthenticated remote attackers to achieve full system compromise, necessitating an immediate update to patched versions.

This is an SQL injection vulnerability (CWE-89) affecting the /reset_password endpoint, which fails to properly sanitize user input, allowing an unauthenticated attacker to execute arbitrary SQL commands.

The vulnerability carries a CVSS score of 10.0, indicating the highest possible severity. Successful exploitation allows an attacker to bypass authentication, access sensitive business data, and potentially take complete control of the underlying server infrastructure, leading to severe data breaches and operational disruption.

Immediate Action: Upgrade your Metabase instance to the fixed versions (x.58.24, x.59.21, x.60.17, x.61.11, or later) immediately.

Proactive Monitoring: Review application and database logs for anomalous requests directed at the /reset_password endpoint, particularly those containing SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting password reset workflows.

Public Exploit Available: No (exploit_available: unknown)

Due to the critical nature of this vulnerability and the lack of authentication required for exploitation, organizations must prioritize patching. Failure to update Metabase immediately exposes the entire data environment to unauthorized access and potential total system compromise.