CVE-2023-38646

criticalpriority · act · 84EPSS 0.996 · 100 %ileexploit · weaponizedEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

38 exploits · weaponized

Likely / severe?

99.6% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

13 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-26

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287US

exploits (38)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/metabase_setup_token_rceMetabase Setup Token RCEweaponized · metasploit
0utl4nder/Another-Metabase-RCE-CVE-2023-38646Metabase postgres (org.h2.Driver) RCE without INITPoC · poc_in_github
0xrobiul/CVE-2023-38646Metabase Pre-auth RCE (CVE-2023-38646)!!PoC · poc_in_github
AnvithLobo/CVE-2023-38646RCE Exploit for CVE-2023-38646PoC · poc_in_github
Any3ite/cve-2023-38646-metabase-ReverseShellAny3ite/cve-2023-38646-metabase-ReverseShellPoC · poc_in_github
Boogipop/MetabaseRceToolsCVE-2023-38646 Metabase RCEPoC · poc_in_github

affected products (13)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Metabase Inc Metabase≤ 0.43.7.2fstec_bduRU
Metabase Inc Metabase0.44.0 → 0.44.7.1fstec_bduRU
Metabase Inc Metabase0.45.0 → 0.45.4.1fstec_bduRU
Metabase Inc Metabase0.46.0 → 0.46.6.1fstec_bduRU
metabase metabase< 0.43.7.2nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabase metabase< 1.43.7.2nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabase metabase0.44.0 → 0.44.7.1nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabase metabase0.45.0 → 0.45.4.1nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabase metabase0.46.0 → 0.46.6.1nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabase metabase1.44.0 → 1.44.7.1nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabase metabase1.45.0 → 1.45.4.1nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*
metabase metabase1.46.0 → 1.46.6.1nvdUScpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2023-07-21modified 2026-06-17

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan