2026-08-09 · view entry permalink →
Metabase: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances — exploited since 3 August, and no CVE was ever assigned
Metabase, an open-source business-intelligence platform run both self-hosted and as a managed cloud service, disclosed on 2026-08-06 that its own Metabase Cloud environment had been attacked by someone using an unknown vulnerability affecting versions 1.58 and above, and that it blocked the endpoints used in the attack before identifying and patching the flaw (Metabase, 2026-08-06). The mechanism matters more than the platform: an unauthenticated caller injects arbitrary SQL against the Metabase application database, and that yields administrator access to the instance — from which the attacker can change the application configuration, steal the stored credentials Metabase holds for the databases it connects to, read anything reachable through those connections, and export it (Metabase, 2026-08-06). Neither the vendor nor the reporting locates the injection point precisely, but the vendor's stated interim workaround for anyone who cannot upgrade immediately is to block the /api/session/reset_password endpoint outright, and its published attack pattern runs through that same route (Metabase, 2026-08-06). BleepingComputer, quoting the associated security advisory, reports it is rated critical at CVSS 10.0 with active exploitation confirmed, and that no CVE identifier was assigned (BleepingComputer, 2026-08-07).
The exposure split is the part defenders need to act on. Metabase Cloud customers were upgraded and patched by the vendor, while self-hosted instances remain vulnerable until an administrator upgrades them by hand (Metabase, 2026-08-06). The minimum safe point releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 for their respective branches, and anything on a lower point release of those branches is still vulnerable; installations below version 58 are not affected (Metabase, 2026-08-06).
Two organisations have confirmed data theft from their own instances. Framework, the laptop manufacturer, told customers that the attackers stole full names, email addresses, login IP addresses, billing and shipping address details, phone numbers and company names, with VAT, EIN and billing email address additionally in scope for its business customers, and said Metabase notified it on 6 August that its instance had been vulnerable and was accessed on 3 August (BleepingComputer, 2026-08-07). Tally, an online form builder, notified users that its Metabase analytics environment was compromised on the same date and that the attackers reached email addresses and password hashes, while its forms and the responses submitted to them are stored separately and were not reached (BleepingComputer, 2026-08-07). Those two are the confirmed victims; no other organisation has been reported as having data taken through this flaw.
Detection is unusually well specified for a flaw with no CVE, because the vendor published the request sequence rather than indicators. The attack shows up as a call to POST /api/session/reset_password returning a 400 status code followed by a call to GET /api/user/current returning 200, and Metabase states that finding that pattern in application logs or in Metabase server ingress logs means the instance was likely compromised (Metabase, 2026-08-06). After upgrading, the vendor's own follow-up steps for any instance whose reset endpoint was publicly reachable are to revoke every active session by deleting all rows in the core_session table, review and delete unrecognised API keys, check administrator accounts for unexpected changes, rotate the credentials for every connected database, and review both data-warehouse logs and Metabase's own activity and query history for unauthorised access (Metabase, 2026-08-06).
Triage: a 400 on the password-reset route is ordinary — users mistype addresses and reset flows reject malformed requests all day, and on its own the 400 means nothing. The discriminator is what follows it from the same source: an unauthenticated client that is genuinely failing a password reset has no session and cannot then get a 200 from /api/user/current, so it is the ordering and the success of the second call that separate exploitation from noise (Metabase, 2026-08-06).
We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above.
After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance.
If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.
This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance,