Exploit for CVE-2023-38646

kitploit · 2026-08-26

Description

Pre-auth RCE in Metabase enabling unauthenticated remote code execution.

Entry point

Parametertoken · path

Path/api/setup/validate

Endpoint used to validate and deploy payload to trigger RCE

Affected Metabase versions

Metabase< 0.43.7.2, 1.43.7.2, 0.44.7.1, 0.45.4.1, 0.46.6.1, 1.44.7.1, 1.45.4.1, 1.46.6.1

All known vulnerabilities by product

CVSS 9.8 for CVE-2023-38646

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

References

https://github.com/0xrobiul/CVE-2023-38646

Exploit Details

Modified:2026-08-26 07:35

Last Seen:2026-08-26 10:07

Reporter:KitPloit

Tags

MetabasePre-auth RCERemote Code ExecutionUnauthenticated

Other exploits for CVE-2023-38646

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

POC_Metabase_CVE-2023-38646

2026-08-27 KitPloitKITPLOIT

CVE-2023-38646-PoC

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

Exploit Code

MARKDOWN11 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-0XROBIUL-CVE-2023-38646
#  CVE-2023-38646   


#### Metabase Pre-auth RCE!!

![](https://img.shields.io/static/v1?label=Project&message=CVE-2023-38646&color=green) ![](https://img.shields.io/twitter/follow/0xrobiul?style=social) ![](https://img.shields.io/youtube/views/b51LPjD-uTo?style=social) ![](https://img.shields.io/static/v1?label=Version&message=1.0&color=green)

# 

Controlla il POC di sfruttamento manuale: https://youtu.be/b51LPjD-uTo