CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2023-38646Public Exploit

Metabase - RCE (CVE-2023-38646)

PublishedJul 21, 2023
First SeenN/A
Last Seen
Reported
CVSS9.8
Metabase
MetabaseMetabase
enterprise_softwareweb_application

Description

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

psychologyCrowdSec Analysis

CVE-2023-38646 is a critical remote code execution vulnerability in Metabase open source and Enterprise editions prior to specific patched versions, allowing unauthenticated attackers to execute arbitrary commands on the server with full privileges. This flaw can be exploited remotely without authentication, potentially leading to complete system compromise, data theft, or further attacks within the affected environment.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-38646 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit Metabase servers by sending crafted requests to endpoints such as /api/session/properties and /api/setup/validate, using the setup token to inject malicious database connection parameters and achieve remote code execution.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2023-07-21
Rule Released2026-04-08

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References