Metabase SQLi Zero-Day Flaw Grants Attackers Admin Access and Steals Database Credentials

A critical SQL injection vulnerability in Metabase is under active zero-day exploitation, allowing unauthenticated attackers to seize administrator control of instances and steal connected database credentials. The flaw has already breached multiple organizations, including laptop maker Framework, form builder Tally, and LexisNexis.

What Happened: Metabase SQLi Zero-Day Grants Attackers Admin Access

Metabase disclosed on August 6, 2026, that its managed Cloud platform had been compromised by an attacker exploiting a previously unknown vulnerability. The flaw affects Metabase versions 1.58 and above, including self-hosted installations.

Metabase CEO Sameer Al-Sakran confirmed the incident in a blog post, warning that the attacker leveraged an unauthenticated SQL injection flaw in the /api/session/reset_password endpoint. Consequently, attackers could inject arbitrary SQL into the Metabase application database. Furthermore, successful exploitation grants full administrator privileges to the instance.

From there, attackers can change application configurations, steal stored credentials for connected databases, read any accessible data, and export records. Metabase has assigned the vulnerability a Critical severity rating with a CVSS score of 10.0. The company has confirmed active exploitation in the wild.

Technical Details of the Metabase SQL Injection Flaw

The vulnerability is an unauthenticated SQL injection in the password reset API endpoint. Attackers do not need valid credentials to exploit it.

The attack chain is straightforward:

• The attacker sends a crafted POST request to /api/session/reset_password, which returns a 400 status code.
• This is followed by a successful GET request to /api/user/current with a 200 status code.

If both requests appear in application or ingress logs, the instance is likely compromised. The attacker can then run arbitrary SQL against the internal application database, pivot to connected data warehouses, and exfiltrate sensitive records.

The affected versions span from 1.58 through 0.63. Metabase Cloud instances have already been patched automatically. However, self-hosted installations remain vulnerable until administrators upgrade manually.

Business and Operational Impact

The breach has already caused significant damage across multiple sectors:

• Framework: The laptop manufacturer confirmed that attackers stole customer full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers, and company names. Framework for Business customers also had VAT, EIN, and billing email addresses exposed.
• Tally: The online form builder reported that attackers accessed user email addresses and password hashes from its Metabase analytics environment. However, user forms and submitted answers were stored separately and were not reached.
• LexisNexis: The legal information giant disclosed unusual activity on third-party-hosted servers affecting its Diligence, Metabase API, and Newsdesk applications. LexisNexis disconnected the systems while a forensic investigation continues.

Moreover, any organization using Metabase to connect to data warehouses faces credential theft and downstream data exposure. The CVSS 10.0 rating reflects complete loss of confidentiality, integrity, and availability.

Mitigation and Recommendations

Metabase has released patched versions for all affected branches. Organizations should upgrade immediately.

Immediate Actions for Defenders

1. Upgrade to the minimum safe release for your Metabase version:
   • 0.58.x users → upgrade to 0.58.24 or later
   • 0.59.x users → upgrade to 0.59.21 or later
   • 0.60.x users → upgrade to 0.60.17 or later
   • 0.61.x users → upgrade to 0.61.11 or later
   • 0.62.x users → upgrade to 0.62.9 or later
   • 0.63.x users → upgrade to 0.63.5 or later
2. If immediate patching is impossible, temporarily block access to the /api/session/reset_password endpoint at the network or reverse-proxy level.
3. After upgrading, delete all rows in the core_session table to revoke active sessions.
4. Review all API keys and administrator accounts for unauthorized changes.
5. Rotate credentials for every connected database.
6. Inspect data warehouse logs and Metabase query history for unauthorized access.

Detection Guidance

Security teams should hunt for the following pattern in logs:

• A POST request to /api/session/reset_password returning HTTP 400.
• A subsequent GET request to /api/user/current returning HTTP 200.

Therefore, any instance showing this sequence should be treated as compromised until proven otherwise.

Bottom line: This is a CVSS 10.0 unauthenticated SQL injection with confirmed active exploitation. Any publicly exposed Metabase instance running version 1.58 or above is at immediate risk. Patch now, rotate credentials, and audit connected systems.

Incident Summary

Incident:	Metabase SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf)
Affected Systems:	Metabase versions 1.58 and above, including Cloud and self-hosted instances
Disclosure Date:	August 6, 2026
Patch Status:	Patches available for all affected branches; Cloud instances auto-updated
CVSS Score:	10.0 (Critical)
Known Victims:	Framework, Tally, LexisNexis
Attack Vector:	Unauthenticated SQL injection via /api/session/reset_password
Minimum Safe Versions:	0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5

References

1. Metabase, “Security update available for Metabase,” August 6, 2026, https://www.metabase.com/blog/security-update, accessed August 7, 2026.
2. Metabase, “SQL injection using an unauthenticated endpoint leading to admin access,” GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, August 6, 2026, https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf, accessed August 7, 2026.
3. BleepingComputer, “Metabase SQLi zero-day exploited in customer data-theft attacks,” Bill Toulas, August 7, 2026, https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/, accessed August 7, 2026.