Metabase Battles CVSS 10.0 Zero-Day Flaw Under Active Exploit

Executive Summary

Metabase, an open-source business intelligence (BI) platform, is grappling with a critical zero-day vulnerability that is being actively exploited in the wild. The flaw is an unauthenticated SQL injection with a CVSS score of 10.0, the highest possible severity. It allows a remote attacker to gain complete administrator privileges on a vulnerable Metabase instance without any prior authentication. The attack vector is the /api/session/reset_password endpoint. Attackers are leveraging this access to steal credentials for connected databases and exfiltrate sensitive corporate and customer data. Metabase has released patches for all affected versions and is strongly urging all self-hosted customers to upgrade immediately. Several organizations, including Framework and Tally, have already confirmed they were compromised via this vulnerability.

Vulnerability Details

The vulnerability is a classic, yet highly impactful, unauthenticated SQL injection. It exists in the code responsible for handling password reset requests.

• Vulnerability Type: Unauthenticated SQL Injection
• Attack Vector: Network
• Prerequisites: Access to the Metabase instance's web interface.
• Affected Endpoint: /api/session/reset_password

An attacker can send a specially crafted request to this endpoint, injecting malicious SQL commands into the token parameter of the password reset process. Because the application fails to properly sanitize this input before using it in a database query, the attacker's SQL code is executed by the Metabase application's backend database. This allows the attacker to manipulate the password reset process for any user, including the administrator account, and gain control of the instance.

Affected Systems

The vulnerability affects multiple versions of the self-hosted Metabase product. Metabase Cloud instances were patched by the company.

• Affected Versions:
  • x.58.0 and above
• Patched Versions:
  • x.58.24
  • x.59.21
  • x.60.17
  • x.61.11
  • x.62.9
  • x.63.5

Organizations running any self-hosted version of Metabase from x.58.0 onwards should assume they are vulnerable and take immediate action.

Exploitation Status

This vulnerability is actively exploited in the wild as a zero-day. Metabase themselves detected the attacks against their own cloud platform around August 3, 2026. The public disclosure on August 8, 2026, came after patches were made available. The ease of exploitation and the high value of the potential data access mean that widespread automated scanning and exploitation is highly likely.

Once an attacker gains administrator access, they can perform a number of malicious actions:

1. Steal Database Credentials: Access the Metabase admin settings to view and copy connection strings for all configured databases.
2. Exfiltrate Data: Use the BI tool's legitimate functionality to query and export sensitive data from all connected databases.
3. Maintain Persistence: Create new administrator accounts or modify system settings.

Impact Assessment

The impact of this vulnerability is catastrophic. A CVSS score of 10.0 reflects the worst-case scenario: an unauthenticated, remote attacker can gain full control of the application and, by extension, gain read access to potentially all data the organization analyzes. For companies like Framework and Tally, this led to the exposure of customer PII. For others, it could mean the theft of financial data, intellectual property, or strategic business intelligence. The reputational damage and potential regulatory fines (e.g., under GDPR or CCPA) are also significant.

IOCs — Directly from Articles

No specific IP addresses, domains, or file hashes were provided in the source articles.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

Security teams should take the following steps to detect potential compromise:

1. Scan Web Logs: Immediately search all historical web server and load balancer logs for POST requests to /api/session/reset_password. Analyze the source IP addresses and user agents for any suspicious patterns.
2. Audit Metabase Users: Log into your Metabase instance and check for any unfamiliar administrator accounts. Review the audit log for all user creations and permission changes.
3. Review Metabase Logs: Examine application logs for errors related to the password reset function or for successful password changes for admin accounts that were not initiated by your team.
4. Monitor Database Activity: Check the logs of your connected data warehouses and databases for any unusual queries originating from the Metabase user account, especially queries that run at odd hours or access an unusually large number of tables or rows.

For detection, D3FEND's Network Traffic Analysis (D3-NTA) and Log Analysis are critical.

Remediation Steps

1. Patch Immediately: The most critical step is to upgrade your Metabase instance to a patched version as listed above. This is the only way to fully remediate the vulnerability.
2. Temporary Mitigation: If patching is not immediately possible, block all external access to the /api/session/reset_password endpoint at your web application firewall (WAF) or reverse proxy. This is a temporary measure and should not be considered a substitute for patching.
3. Assume Compromise: If you were running a vulnerable version, you must assume you have been compromised. Initiate your incident response plan.
4. Rotate All Credentials: After patching, rotate the credentials for ALL databases and data sources connected to Metabase. Attackers likely stole the old credentials.
5. Review for Persistence: Thoroughly audit all users, settings, and configurations within Metabase to ensure attackers have not left backdoors.