Every CVE Search/ Get API key

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to...

9.8 CriticalPublic exploit

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.5%Up 99.4 points since Jul 22, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
CVE-2023-38646
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
CVE List No score

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
CVE-2023-38646
Updated
2026-11-02
EUVDEUVD-2023-42445 No score

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
EUVD-2023-42445
Updated
2026-11-03
GitHub AdvisoriesGHSA-jg32-8h6w-x7vg 9.8

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to...

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
GHSA-jg32-8h6w-x7vg
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV No score

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
CVE-2023-38646
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitMetabase Setup Token RCE2023-07-22
PoC in GitHubPumpkin-Garden/POC_Metabase_CVE-2023-386462023-07-28
PoC in GitHub0xrobiul/CVE-2023-386462023-07-29
PoC in GitHubChocapikk/CVE-2023-386462023-07-30
PoC in GitHubXuxfff/CVE-2023-38646-Poc2023-07-30
PoC in GitHubsecurezeron/CVE-2023-386462023-07-30
PoC in GitHubZenmovie/CVE-2023-386462023-07-31
PoC in GitHubraytheon0x21/CVE-2023-386462023-07-31
PoC in GitHubshamo0/CVE-2023-38646-PoC2023-08-02
PoC in GitHubfidjiw/CVE-2023-38646-POC2023-08-03
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubAny3ite/cve-2023-38646-metabase-ReverseShell2023-08-09
PoC in GitHubrobotmikhro/CVE-2023-386462023-08-09
PoC in GitHubkh4sh3i/CVE-2023-386462023-08-19
PoC in GitHubalexandre-pecorilla/CVE-2023-386462023-10-08
PoC in GitHubyxl2001/CVE-2023-386462023-10-08
PoC in GitHubm3m0o/metabase-pre-auth-rce-poc2023-10-09
PoC in GitHubCN016/Metabase-H2-CVE-2023-38646-2023-10-10
PoC in GitHubBoogipop/MetabaseRceTools2023-10-11
PoC in GitHubnickswink/CVE-2023-386462023-10-11
PoC in GitHubpasswa11/CVE-2023-386462023-10-12
PoC in GitHubthreatHNTR/CVE-2023-386462023-10-12
PoC in GitHubasepsaepdin/CVE-2023-386462023-10-14
PoC in GitHubPyr0sec/CVE-2023-386462023-10-15
PoC in GitHubbirdm4nw/CVE-2023-386462023-10-17
PoC in GitHubAnvithLobo/CVE-2023-386462023-10-20
PoC in GitHubRed4mber/CVE-2023-386462023-10-25
NucleiMetabase < 0.46.6.1 - Remote Code Execution

Plus 13 more. The full list has every link.

History

History
RecordedChangedSources
exploits, exploits_more
exploits
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-38646 is a critical vulnerability (CVSS 9.8) in Metabase, published July 21, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.5%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open