CVE-2023-38646: Metabase unauthenticated remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8 and an EPSS above the 99th percentile makes this an urgent patch target.

What it is

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server at the server's privilege level. Authentication is not required, so any reachable instance is exposed. The record does not specify the exact vulnerable component or root cause beyond the CWE being listed as insufficient information.

Impact

An unauthenticated attacker can run arbitrary commands on the Metabase server, gaining the privileges of the Metabase process and potentially full control of the host and its data.

Attack surface

Reachable over the network via the Metabase HTTP interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The record does not identify the specific endpoint or parameter involved.

Exploitation

Not listed in CISA KEV, but EPSS is 0.98677 (99.9th percentile), indicating very high predicted exploitation activity. Public Packet Storm exploit write-ups and vendor advisory references are present, so working exploit code is publicly available.

What to do

• Upgrade to a fixed release: 0.46.6.1 or 1.46.6.1, or the backport fixes 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, 1.43.7.2.
• If immediate patching is not possible, restrict network access to the Metabase instance to trusted users and networks only.
• Place Metabase behind an authenticating reverse proxy or VPN so unauthenticated requests cannot reach it.
• Run the Metabase service with a least-privilege OS account and limit its access to backend databases and filesystem paths.
• Monitor vendor advisory and release notes for any further guidance on the flaw.

Detection

• Review Metabase server logs and HTTP access logs for anomalous requests, especially unauthenticated POSTs or requests to unusual endpoints.
• Monitor for unexpected child processes spawned by the Metabase service account, such as shells or command interpreters.
• Alert on outbound network connections from the Metabase host to unfamiliar external addresses.
• Check for signs of post-exploitation activity on Metabase hosts, including new files, scheduled tasks, or credential access attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.