CVE-2023-38646: Metabase pre-authentication remote code execution
The short version: Metabase — the open-source and enterprise business-intelligence tool — has a flaw (CVE-2023-38646) that lets an unauthenticated attacker execute arbitrary commands on the server at Metabase's privilege level. It scores 9.8, and after a public proof-of-concept appeared it was exploited broadly against internet-facing instances. It is not in CISA's KEV catalog, but the practical risk is high. If you run Metabase below the fixed builds, patch now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, widely exploited after public PoC |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~97.92% · 99.90th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Yes — widely exploited in the wild following a public proof-of-concept (not currently in CISA KEV) |
| Vulnerability type | Pre-authentication command execution → remote code execution at the server's privilege level |
| Requires authenticated session? | No — authentication is not required |
| Affected | Metabase open source before 0.46.6.1; Metabase Enterprise before 1.46.6.1 |
| Fixed in | 0.46.6.1 / 1.46.6.1 (also backported: 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, 1.43.7.2) |
What you need to know
Metabase is a data-analytics front-end that teams routinely expose so people can reach dashboards. CVE-2023-38646 abuses the application's setup/database-connection handling: an unauthenticated request reaches a code path that lets an attacker run commands on the underlying server, at whatever privilege the Metabase process holds.
- It's pre-authentication. No login, no chain — a crafted request is enough.
- It's internet-facing by design. BI tools are stood up to be reachable, which is exactly what makes this dangerous.
- It was widely exploited. A public PoC turned a serious bug into opportunistic mass scanning and exploitation; an exposed, unpatched instance may already be touched.
How serious we see it
High — unauthenticated, network-reachable code execution on an internet-facing application, with documented mass exploitation.
It's worth being precise about the KEV point: this flaw is not in CISA's KEV catalog, so we don't claim a federal remediation deadline. But absence from KEV doesn't lower the real risk — the public reporting of in-the-wild exploitation and the near-top EPSS both say the same thing, and we rate by real-world behavior. The bounded, reassuring part: it affects specific builds, the fixes (including backports to older release lines) are published, and exposure is quick to determine.
Recommendations
- Patch now. Upgrade to 0.46.6.1 / 1.46.6.1, or the backported fix for your release line (0.45.4.1, 0.44.7.1, 0.43.7.2, or the matching enterprise builds).
- Hunt. Review Metabase and host logs for unexpected setup requests and command execution around the exposure window.
- If compromised, respond. Rebuild the host, rotate the database credentials Metabase holds and any secrets reachable from it, and check for persistence.
- Reduce exposure. Put Metabase behind SSO/VPN where feasible rather than exposing it directly.
- Confirm your exposure first. Verify whether you run Metabase and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Metabase instances from little more than your domain, fingerprints the version, and flags exposure tied to this vulnerability. We detect and prioritize the exposed, affected instance rather than exploiting it — and because our severity take reflects the documented in-the-wild activity, a mass-exploited RCE like this rises to the top of your results even though it isn't carrying a KEV label.