2026-08-09 · view entry permalink →
Metabase: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since 3 August, and no CVE was ever assigned
Metabase, an open-source business-intelligence platform run both self-hosted and as a managed cloud service, disclosed on 2026-08-06 that its own Metabase Cloud environment had been attacked by someone using an unknown vulnerability affecting versions 1.58 and above, and that it blocked the endpoints used in the attack before identifying and patching the flaw (Metabase, 2026-08-06). The mechanism matters more than the platform: an unauthenticated caller injects arbitrary SQL against the Metabase application database, and that yields administrator access to the instance, from which the attacker can change the application configuration, steal the stored credentials Metabase holds for the databases it connects to, read anything reachable through those connections, and export it (Metabase, 2026-08-06). Neither the vendor nor the reporting locates the injection point precisely, but the vendor's stated interim workaround for anyone who cannot upgrade immediately is to block the /api/session/reset_password endpoint outright, and its published attack pattern runs through that same route (Metabase, 2026-08-06). BleepingComputer, quoting the associated security advisory, reports it is rated critical at CVSS 10.0 with active exploitation confirmed, and that no CVE identifier was assigned (BleepingComputer, 2026-08-07).
The exposure split is the part defenders need to act on. Metabase Cloud customers were upgraded and patched by the vendor, while self-hosted instances remain vulnerable until an administrator upgrades them by hand (Metabase, 2026-08-06). The minimum safe point releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 for their respective branches, and anything on a lower point release of those branches is still vulnerable; installations below version 58 are not affected (Metabase, 2026-08-06).
Two organisations have confirmed data theft from their own instances. Framework, the laptop manufacturer, told customers that the attackers stole full names, email addresses, login IP addresses, billing and shipping address details, phone numbers and company names, with VAT, EIN and billing email address additionally in scope for its business customers, and said Metabase notified it on 6 August that its instance had been vulnerable and was accessed on 3 August (BleepingComputer, 2026-08-07). Tally, an online form builder, notified users that its Metabase analytics environment was compromised on the same date and that the attackers reached email addresses and password hashes, while its forms and the responses submitted to them are stored separately and were not reached (BleepingComputer, 2026-08-07). Those two are the confirmed victims; no other organisation has been reported as having data taken through this flaw.
Detection is unusually well specified for a flaw with no CVE, because the vendor published the request sequence rather than indicators. The attack shows up as a call to POST /api/session/reset_password returning a 400 status code followed by a call to GET /api/user/current returning 200, and Metabase states that finding that pattern in application logs or in Metabase server ingress logs means the instance was likely compromised (Metabase, 2026-08-06). After upgrading, the vendor's own follow-up steps for any instance whose reset endpoint was publicly reachable are to revoke every active session by deleting all rows in the core_session table, review and delete unrecognised API keys, check administrator accounts for unexpected changes, rotate the credentials for every connected database, and review both data-warehouse logs and Metabase's own activity and query history for unauthorised access (Metabase, 2026-08-06).
Triage: a 400 on the password-reset route is ordinary, users mistype addresses and reset flows reject malformed requests all day, and on its own the 400 means nothing. The discriminator is what follows it from the same source: an unauthenticated client that is genuinely failing a password reset has no session and cannot then get a 200 from /api/user/current, so it is the ordering and the success of the second call that separate exploitation from noise (Metabase, 2026-08-06).
We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above.
After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance.
If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.
This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance,
Metabase has confirmed active exploitation of this vulnerability.
This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance.
This brings the number of publicly confirmed downstream organizations tracked by VenariX to nine.
Credential rotation is especially important if exploitation is suspected, because patching the application does not invalidate credentials that may already have been exposed.
Metabase states that this pattern in application or ingress logs indicates that the instance was likely compromised.
The entry on Metabase's unauthenticated SQL-injection zero-day closed on the observation that no CVE identifier had been assigned, so a purely CVE-driven patch process would not surface the exposure at all. That gap is now closed in both directions. GitHub Security Advisory GHSA-vwf4-m7j8-wcjf assigns CVE-2026-72898 with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and Metabase's own advisory text states that "Metabase has confirmed active exploitation of this vulnerability" and that the flaw "allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance" (Metabase, 2026-08-06). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-08-11 with a 14 August due date (CISA, 2026-08-11).
The second half of the delta is the affected-version matrix, which the vendor's original blog post did not carry in this form. The advisory lists the affected ranges per release line as >= x.58.0 < x.58.23, >= x.59.0 < x.59.20, >= x.60.0 < x.60.16, >= x.61.0 < x.61.10, >= x.62.0 < x.62.8 and >= x.63.0 < x.63.3, and names the patched versions separately as x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5; note the two lists do not meet, so a build sitting between an affected upper bound and its patched release is not described either way and should be treated as needing the named patched version (Metabase, 2026-08-06). That turns "upgrade Metabase" into a query an asset inventory can answer, and it is what a scanner needed in order to report anything at all.
Nothing here changes the exposure of an instance that has not been upgraded; the exploitation window has been open since at least 3 August per the earlier coverage, and the interim control is unchanged: block the /api/session/reset_password endpoint if an upgrade cannot happen immediately. What changed is visibility, and that is the operationally useful part. An organisation whose vulnerability management runs off CVE identifiers, SBOM matching or KEV feeds got no signal on this flaw for over a week while it was being exploited; the same tooling will now produce a finding on the next scan cycle. The advisory's post-upgrade guidance also stands and is worth re-reading against what an attacker with administrator access would already have taken: revoke active sessions, audit API keys and administrator accounts, and rotate the stored credentials for every connected data source, because those credentials are what an instance-level compromise reaches.
The count of downstream victims is now the story. A tracker maintained by VenariX, first published 2026-08-10 and updated 2026-08-17, states that "This brings the number of publicly confirmed downstream organizations tracked by VenariX to nine" (VenariX, 2026-08-17), n8n, Framework, Tally and Kilo Code from the first wave, with Stocksy United Co-op, ShipMonk, Checkly, Cypress.io and Bits of Gold added on 2026-08-17. The earlier entries covered the flaw itself: an unauthenticated SQL injection reachable at the password-reset endpoint, CVSS 10.0, exploited, catalogued as such on 2026-08-11.
The mechanism behind the growing list is a property of business-intelligence tooling rather than of this bug. Metabase stores the connection configuration, including credentials, for every external database and warehouse it queries; an attacker who reaches administrative context in the application can therefore read those stored credentials and query or export whatever they reach (VenariX, 2026-08-17). The blast radius of any given instance is set entirely by what it was wired to; VenariX's own framing is that a deployment connected only to a restricted reporting database is a materially different incident from one connected to a production warehouse, which is the assessment question a defender should be answering first.
The victim disclosures show the range. n8n's investigation found the attacker queried 136 records containing names and email addresses, five of which also carried bcrypt password hashes tied to n8n Cloud accounts, and reported that the queries returned a variable set of rows, which prevented it from determining exactly which individual records were returned. Framework confirmed customer data was stolen including names, email addresses, phone numbers, login IP addresses and billing and shipping addresses, with payment information not included. Tally's exposure covered email addresses and password hashes while form content was stored separately and unaffected, and Kilo Code's included names, email addresses, billing addresses, location data and, for a subset of users, partial or full prompts (VenariX, 2026-08-17). Of the newly added names, Bits of Gold separately disclosed on 2026-08-17 that an attacker gained unauthorized access to a third-party data analytics network and obtained names, national ID numbers and emails for roughly 200,000 customers (DataBreaches.net, 2026-08-17), the company describes the platform class, not the product, and it is VenariX that places the incident in this campaign.
The operational point is the one most likely to be got wrong in a remediation ticket. Metabase's own guidance, as VenariX relays it, is that "Credential rotation is especially important if exploitation is suspected, because patching the application does not invalidate credentials that may already have been exposed" (VenariX, 2026-08-17). An estate that upgraded Metabase and closed the ticket has fixed the injection and left the attacker holding working warehouse credentials. Metabase's fuller recommendation set for potentially exposed instances is to revoke active sessions, review administrator accounts and API keys, rotate credentials for connected databases, and review both Metabase and warehouse logs; where an immediate upgrade is impossible it recommends temporarily blocking access to the reset-password endpoint.
Detection has an unusually crisp anchor for a SQL-injection flaw, because the vendor published one. Metabase identified a recurring two-request pattern associated with exploitation (a POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200) and "Metabase states that this pattern in application or ingress logs indicates that the instance was likely compromised" (VenariX, 2026-08-17). Beyond that, the investigative surface is Metabase's own query history, database and warehouse audit logs, administrator accounts, API keys, and any unexpected use of the stored connection credentials; the last being where a compromise that started in the BI tier becomes visible in the warehouse tier.
Triage: a failed password reset followed by a session check is not by itself unusual in a web application's logs, which is exactly why the ordered pair matters rather than either request alone; a genuine failed reset does not produce an authenticated /api/user/current success on the same session immediately afterwards. Downstream, the discriminator for warehouse activity is whether queries arriving under the Metabase service credential match the dashboards and questions that credential is actually used for: bulk selects against tables no saved question references, or access at hours the reporting schedule does not run, are the signal, while high query volume under that identity is normal by design.