Advisory: Metabase Pre-Auth RCE (CVE-2023-38646)

Summary An unauthenticated attacker can obtain the setup token for an instance and use it to achieve remote code execution via an endpoint that allows you to validate a H2 database connection. When validating the database, the H2 JDBC driver allows for the attacker to achieve RCE. Impact An attacker can execute arbitrary Java code on the system, leading to arbitrary command execution. Affected Software Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers t