A critical SQL injection vulnerability in Metabase allows unauthenticated remote attackers to compromise the underlying database, posing a severe risk to data confidentiality and integrity.

This is an SQL injection flaw (CWE-89) triggered by improper input validation of field-filter parameters in shared cards or dashboards. The vulnerability is exploitable by unauthenticated attackers, enabling unauthorized database interaction.

Successful exploitation allows an attacker to bypass application controls and execute arbitrary queries against the backend database. This can result in full data exfiltration, unauthorized modification of records, or complete system compromise, justifying the CVSS score of 10.0.

Immediate Action: Upgrade to the patched versions: x.58.24, x.59.21, x.60.17, x.61.11, or the latest available maintenance release for your specific branch.

Proactive Monitoring: Audit application logs for unusual query patterns or unexpected database errors originating from public-facing dashboard endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect traffic directed at dashboard filter parameters.

Public Exploit Available: Unknown

Given the critical severity and the ease of exploitation, organizations must prioritize patching Metabase immediately. Ensure that all public-facing dashboards are reviewed and updated to the latest secure versions to prevent unauthorized access to sensitive business data.