# CVE-2023-38646: Metabase - RCE

> Live exploitation tracking for CVE-2023-38646 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-38646

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Metabase
- **Tags:** enterprise_software, web_application

## Description

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

## CrowdSec analysis

[CVE-2023-38646](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-38646) is a critical remote code execution vulnerability in Metabase open source and Enterprise editions prior to specific patched versions, allowing unauthenticated attackers to execute arbitrary commands on the server with full privileges. This flaw can be exploited remotely without authentication, potentially leading to complete system compromise, data theft, or further attacks within the affected environment.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-38646 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit Metabase servers by sending crafted requests to endpoints such as `/api/session/properties` and `/api/setup/validate`, using the setup token to inject malicious database connection parameters and achieve remote code execution.

## Timeline

- 2023-07-21: CVE Published. CVE-2023-38646 is published to NVD.
- 2026-04-08: Rule Released. CrowdSec releases a rule to detect CVE-2023-38646 exploitation attempts against the CrowdSec Network.

## References

- http://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html
- https://www.metabase.com/blog/security-advisory
- https://github.com/metabase/metabase/releases/tag/v0.46.6.1
- http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.html
- https://github.com/metabase/metabase/issues/32552
- https://news.ycombinator.com/item?id=36812256
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38646.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-38646) follows observed exploitation activity for CVE-2023-38646. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.