Dire Wolf

The entry on Metabase's unauthenticated SQL-injection zero-day closed on the observation that no CVE identifier had been assigned, so a purely CVE-driven patch process would not surface the exposure at all. That gap is now closed in both directions. GitHub Security Advisory GHSA-vwf4-m7j8-wcjf assigns CVE-2026-72898 with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and Metabase's own advisory text states that "Metabase has confirmed active exploitation of this vulnerability" and that the flaw "allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance" (Metabase, 2026-08-06). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-08-11 with a 14 August due date (CISA, 2026-08-11).

The second half of the delta is the affected-version matrix, which the vendor's original blog post did not carry in this form. The advisory lists the affected ranges per release line as >= x.58.0 < x.58.23, >= x.59.0 < x.59.20, >= x.60.0 < x.60.16, >= x.61.0 < x.61.10, >= x.62.0 < x.62.8 and >= x.63.0 < x.63.3, and names the patched versions separately as x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5; note the two lists do not meet, so a build sitting between an affected upper bound and its patched release is not described either way and should be treated as needing the named patched version (Metabase, 2026-08-06). That turns "upgrade Metabase" into a query an asset inventory can answer, and it is what a scanner needed in order to report anything at all.

Nothing here changes the exposure of an instance that has not been upgraded; the exploitation window has been open since at least 3 August per the earlier coverage, and the interim control is unchanged: block the /api/session/reset_password endpoint if an upgrade cannot happen immediately. What changed is visibility, and that is the operationally useful part. An organisation whose vulnerability management runs off CVE identifiers, SBOM matching or KEV feeds got no signal on this flaw for over a week while it was being exploited; the same tooling will now produce a finding on the next scan cycle. The advisory's post-upgrade guidance also stands and is worth re-reading against what an attacker with administrator access would already have taken: revoke active sessions, audit API keys and administrator accounts, and rotate the stored credentials for every connected data source, because those credentials are what an instance-level compromise reaches.

The count of downstream victims is now the story. A tracker maintained by VenariX, first published 2026-08-10 and updated 2026-08-17, states that "This brings the number of publicly confirmed downstream organizations tracked by VenariX to nine" (VenariX, 2026-08-17), n8n, Framework, Tally and Kilo Code from the first wave, with Stocksy United Co-op, ShipMonk, Checkly, Cypress.io and Bits of Gold added on 2026-08-17. The earlier entries covered the flaw itself: an unauthenticated SQL injection reachable at the password-reset endpoint, CVSS 10.0, exploited, catalogued as such on 2026-08-11.

The mechanism behind the growing list is a property of business-intelligence tooling rather than of this bug. Metabase stores the connection configuration, including credentials, for every external database and warehouse it queries; an attacker who reaches administrative context in the application can therefore read those stored credentials and query or export whatever they reach (VenariX, 2026-08-17). The blast radius of any given instance is set entirely by what it was wired to; VenariX's own framing is that a deployment connected only to a restricted reporting database is a materially different incident from one connected to a production warehouse, which is the assessment question a defender should be answering first.

The victim disclosures show the range. n8n's investigation found the attacker queried 136 records containing names and email addresses, five of which also carried bcrypt password hashes tied to n8n Cloud accounts, and reported that the queries returned a variable set of rows, which prevented it from determining exactly which individual records were returned. Framework confirmed customer data was stolen including names, email addresses, phone numbers, login IP addresses and billing and shipping addresses, with payment information not included. Tally's exposure covered email addresses and password hashes while form content was stored separately and unaffected, and Kilo Code's included names, email addresses, billing addresses, location data and, for a subset of users, partial or full prompts (VenariX, 2026-08-17). Of the newly added names, Bits of Gold separately disclosed on 2026-08-17 that an attacker gained unauthorized access to a third-party data analytics network and obtained names, national ID numbers and emails for roughly 200,000 customers (DataBreaches.net, 2026-08-17), the company describes the platform class, not the product, and it is VenariX that places the incident in this campaign.

The operational point is the one most likely to be got wrong in a remediation ticket. Metabase's own guidance, as VenariX relays it, is that "Credential rotation is especially important if exploitation is suspected, because patching the application does not invalidate credentials that may already have been exposed" (VenariX, 2026-08-17). An estate that upgraded Metabase and closed the ticket has fixed the injection and left the attacker holding working warehouse credentials. Metabase's fuller recommendation set for potentially exposed instances is to revoke active sessions, review administrator accounts and API keys, rotate credentials for connected databases, and review both Metabase and warehouse logs; where an immediate upgrade is impossible it recommends temporarily blocking access to the reset-password endpoint.

Detection has an unusually crisp anchor for a SQL-injection flaw, because the vendor published one. Metabase identified a recurring two-request pattern associated with exploitation (a POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200) and "Metabase states that this pattern in application or ingress logs indicates that the instance was likely compromised" (VenariX, 2026-08-17). Beyond that, the investigative surface is Metabase's own query history, database and warehouse audit logs, administrator accounts, API keys, and any unexpected use of the stored connection credentials; the last being where a compromise that started in the BI tier becomes visible in the warehouse tier.

Triage: a failed password reset followed by a session check is not by itself unusual in a web application's logs, which is exactly why the ordered pair matters rather than either request alone; a genuine failed reset does not produce an authenticated /api/user/current success on the same session immediately afterwards. Downstream, the discriminator for warehouse activity is whether queries arriving under the Metabase service credential match the dashboards and questions that credential is actually used for: bulk selects against tables no saved question references, or access at hours the reporting schedule does not run, are the signal, while high query volume under that identity is normal by design.

The downstream count grows again, and through a further intermediary this entry had not yet named. Shipup, a French platform used by more than 700 e-commerce brands to send delivery-tracking notifications and post-purchase communications, ran a Metabase instance that was compromised through the same CVE-2026-72898 unauthenticated SQL injection, with unauthorized access to the Shipup instance confirmed between 31 July and 17 August 2026, a window that starts earlier than the "since at least 3 August" this entry's own earlier coverage had established for the campaign (Cyberattaque.org, 2026-09-26). At least six of Shipup's retail clients have since notified their own customers of exposure: Carrefour notified some customers in early September, and Cyberattaque.org had already separately documented Printemps, Citadium, Aroma-Zone, Micromania and Easypara as affected through the same Shipup compromise (Cyberattaque.org, 2026-09-26; French Breaches, 2026-09-27). The exposed categories match the pattern this campaign has shown throughout: names, email addresses and phone numbers; Carrefour states no banking data or passwords were affected, and neither its own site, customer accounts nor internal systems were compromised, consistent with the exposure being limited to data it had shared with Shipup for delivery notifications. Carrefour has not disclosed the exact number of customers affected or confirmed whether the exposure window matches Shipup's own 31 July-17 August dates.

Shipup is a new entry in this campaign's chain of intermediary vendors, distinct from the data warehouses and analytics platforms this entry's earlier coverage described (n8n, Kilo Code and the others connected directly to a compromised Metabase instance): here, the retail brands are themselves downstream of a vendor that was downstream of the Metabase flaw, a second hop the credential-rotation and log-review guidance in this entry's original analysis already covers, since it applies to any instance that was reachable and unpatched during the exploitation window regardless of how many contractual layers separate the ultimate data subject from the compromised application.

VenariX's tracker has grown from nine confirmed downstream incidents to fifteen. The additions since the 2026-08-17 count are Privy, Paradigm Connect Asia, Statista, Dodo Payments, Marsello and LEGO Certified Stores South Africa (VenariX, 2026-08-10, revised since). The Shipup compromise and its retail clients, covered in the update of 2026-09-27, are not on that list, so the real total is higher still.

The larger change is who is using the flaw. VenariX says it has confirmed that Dire Wolf, a ransomware and data-extortion group, exploited CVE-2026-72898 in at least two incidents against self-hosted Metabase deployments, at Statista and Dodo Payments, and suspects the group targeted fourteen more companies the same way. It is explicit that it has no evidence Dire Wolf discovered the zero-day or is behind the other confirmed incidents (VenariX, 2026-08-10, revised since). Dodo Payments, a payments company, confirms the vector without naming an actor: an unauthorised party exploited CVE-2026-72898 in a self-hosted Metabase instance used for internal reporting, viewed and queried the reporting datasets that system could reach, and the company contained it within hours of learning of it on 16 August (Dodo Payments, 2026-08-17). A dark-web listing dated 16 August, reviewed but not verified by MediaNama, claims about 60.8 GB and 39.3 million rows from four ClickHouse analytics databases, including tables it labels API keys, one-time passcodes and identity-provider credentials, where Dodo says API keys and credentials were not in the affected system (MediaNama, 2026-09-01).

For a defender this moves the self-hosted exposure from opportunistic data theft to an extortion operator's target list. The dispute over what left Dodo's warehouses is the point this entry has made since August: the reach of a compromised Metabase instance is whatever its stored connections reach, and the vendor's statement of what the BI tool itself held does not bound it. An instance that was internet-reachable on a vulnerable build between late July and its upgrade should be scoped as a warehouse compromise, not an application one.