Every CVESearch/Get API key

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to...

9.8 CriticalPublic exploit

CVE-2023-38646 is a critical vulnerability (CVSS 9.8) in Metabase, published July 21, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.5%, the 99th percentile. No source names a fixed version.

What does this mean?
Severity
9.8 CriticalCVSS 3.1, NVD
Exploit chance
99.5%EPSS, 99th percentile
Exploitation
None known40 public exploits
Fixed in
No fix listedNo source names one

Description

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.5%Up 99.4 points since Jul 22, 2023
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitMetabase Setup Token RCE2023-07-22
PoC in GitHubPumpkin-Garden/POC_Metabase_CVE-2023-386462023-07-28
PoC in GitHub0xrobiul/CVE-2023-386462023-07-29
PoC in GitHubChocapikk/CVE-2023-386462023-07-30
PoC in GitHubXuxfff/CVE-2023-38646-Poc2023-07-30
PoC in GitHubsecurezeron/CVE-2023-386462023-07-30
PoC in GitHubZenmovie/CVE-2023-386462023-07-31
PoC in GitHubraytheon0x21/CVE-2023-386462023-07-31
PoC in GitHubshamo0/CVE-2023-38646-PoC2023-08-02
PoC in GitHubfidjiw/CVE-2023-38646-POC2023-08-03
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubAny3ite/cve-2023-38646-metabase-ReverseShell2023-08-09
PoC in GitHubrobotmikhro/CVE-2023-386462023-08-09
PoC in GitHubkh4sh3i/CVE-2023-386462023-08-19
PoC in GitHubalexandre-pecorilla/CVE-2023-386462023-10-08
PoC in GitHubyxl2001/CVE-2023-386462023-10-08
PoC in GitHubm3m0o/metabase-pre-auth-rce-poc2023-10-09
PoC in GitHubCN016/Metabase-H2-CVE-2023-38646-2023-10-10
PoC in GitHubBoogipop/MetabaseRceTools2023-10-11
PoC in GitHubnickswink/CVE-2023-386462023-10-11
PoC in GitHubpasswa11/CVE-2023-386462023-10-12
PoC in GitHubthreatHNTR/CVE-2023-386462023-10-12
PoC in GitHubasepsaepdin/CVE-2023-386462023-10-14
PoC in GitHubPyr0sec/CVE-2023-386462023-10-15
PoC in GitHubbirdm4nw/CVE-2023-386462023-10-17
PoC in GitHubAnvithLobo/CVE-2023-386462023-10-20
PoC in GitHubRed4mber/CVE-2023-386462023-10-25
NucleiMetabase < 0.46.6.1 - Remote Code Execution

What each source reports

NVD Score used9.8

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
CVE-2023-38646
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
CVE ListNo score

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
CVE-2023-38646
Updated
2026-11-02
EUVDEUVD-2023-42445No score

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
EUVD-2023-42445
Updated
2026-11-03
GitHub AdvisoriesGHSA-jg32-8h6w-x7vg9.8

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to...

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
GHSA-jg32-8h6w-x7vg
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVNo score

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Record
CVE-2023-38646
Updated
2026-11-02

History

History
RecordedChangedSources
exploits, exploits_more
exploits
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

This page doesn't list everything

The full exploit list has 13 more links.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open