Metabase Zero-Day Flaw Exploited to Steal Data
Metabase Zero-Day SQLi Flaw (CVSS 10.0) Actively Exploited
Impact Scope
Affected Companies
Industries Affected
Related Entities(initial)
Products & Tech
Other
CVE Identifiers
Full Report(when first published)
Executive Summary
A critical, unauthenticated SQL injection vulnerability, GHSA-vwf4-m7j8-wcjf, with a CVSS score of 10.0, has been discovered in the Metabase open-source business intelligence platform. The flaw is under active exploitation, allowing threat actors to gain full administrative control over vulnerable instances without authentication. This has led to confirmed data breaches at multiple companies, including Framework and Tally, where attackers stole customer data. Metabase has released patches for all affected versions (1.58 and later) and strongly recommends immediate updates for all self-hosted instances. The vulnerability resides in the password reset endpoint and can be leveraged to extract database credentials stored within Metabase, posing a severe risk to an organization's entire data infrastructure.
Vulnerability Details
The vulnerability is an unauthenticated SQL injection flaw located in the /api/session/reset_password endpoint of the Metabase API. By sending a specially crafted POST request containing a malicious SQL payload, an attacker can manipulate the underlying application database. Successful exploitation allows the attacker to obtain an administrator's session token, effectively granting them complete control over the Metabase instance.
- Vulnerability Type: Unauthenticated SQL Injection
- Affected Endpoint:
/api/session/reset_password - Impact: Full administrative access, credential theft, data exfiltration.
- Attack Vector: An attacker sends a crafted HTTP request to the public-facing API. No user interaction is required.
Once an attacker gains administrator privileges, they have access to all functionalities of the Metabase platform. This includes viewing, modifying, and exfiltrating data from any connected database, as well as accessing the stored credentials for those databases. This turns a compromise of the BI tool into a compromise of the organization's core data stores.
Affected Systems
The vulnerability affects all self-hosted Metabase open-source and enterprise releases from version 1.58 onward. Specifically, the following branches were impacted before the patches were applied:
v1.58.xandv0.58.xv1.59.xandv0.59.xv1.60.xandv0.60.xv1.61.xandv0.61.xv1.62.xandv0.62.xv1.63.xandv0.63.x
Metabase Cloud instances were automatically patched by the company and are no longer vulnerable.
Exploitation Status
The vulnerability is being actively exploited in the wild. Metabase first detected the exploitation around August 3, 2026, when its own Cloud SaaS platform was breached. Following this, multiple companies have publicly disclosed breaches resulting from this zero-day.
- Framework: The laptop manufacturer confirmed a breach where customer names, addresses, and email addresses were stolen.
- Tally: The form-building service also reported a breach with similar data exfiltration.
The absence of a CVE identifier for this vulnerability is notable. It is tracked under a GitHub Security Advisory ID (
GHSA-vwf4-m7j8-wcjf). This means vulnerability scanners relying solely on the National Vulnerability Database (NVD) may fail to detect this critical issue, highlighting the importance of monitoring vendor and GitHub advisories.
Impact Assessment
The business impact of this vulnerability is severe. As a business intelligence tool, Metabase is often connected to an organization's most sensitive and valuable data sources, including production databases, data warehouses, and analytics platforms. A compromise can lead to:
- Mass Data Exfiltration: Attackers can steal vast amounts of customer PII, financial data, and proprietary business information.
- Credential Theft: The ability to extract credentials for connected databases allows attackers to pivot deeper into the network, bypassing other security controls.
- Regulatory Fines: Data breaches involving PII can result in significant fines under regulations like GDPR and CCPA.
- Reputational Damage: Public disclosure of a breach can erode customer trust and damage the company's brand.
Cyber Observables — Hunting Hints
Security teams may want to hunt for the following patterns which could indicate exploitation attempts or a successful compromise:
/api/session/reset_passwordPOST requests./api/user/currentGET request to this endpoint immediately following a request to the password reset endpoint can indicate a successful token hijack.POST /api/session/reset_password (HTTP 400) -> GET /api/user/current (HTTP 200)Detection Methods
Defenders should focus on analyzing web server and application logs for the exploitation pattern described above.
- SIEM/Log Analysis: Create a detection rule that triggers an alert when a source IP address generates a
POSTrequest to/api/session/reset_passwordthat results in an HTTP 400 status, followed within a short time window (e.g., 1 minute) by aGETrequest to/api/user/currentfrom the same IP that results in an HTTP 200 status.title: Metabase Unauthenticated SQLi Exploitation Attempt (GHSA-vwf4-m7j8-wcjf) detection: selection1: http.method: 'POST' url.path: '/api/session/reset_password' http.status_code: 400 selection2: http.method: 'GET' url.path: '/api/user/current' http.status_code: 200 timeframe: 1m condition: selection1 and selection2 on same source.ip - Network Traffic Analysis (D3-NTA): Monitor network traffic for anomalous requests to the Metabase API endpoints, particularly from untrusted or external IP addresses.
- File Analysis (D3-FA): After a suspected compromise, review Metabase configuration files and audit logs for any unauthorized changes, new user accounts, or modified database connections.
Remediation Steps
The primary remediation is to update to a patched version of Metabase immediately.
- Patch: Upgrade to one of the following secure versions or a later release:
v1.58.10/v0.58.10v1.59.6/v0.59.6v1.60.6/v0.60.6v1.61.5/v0.61.5v1.62.4/v0.62.4v1.63.1/v0.63.1
- Workaround (Temporary): If patching is not immediately possible, block all requests to the
/api/session/reset_passwordendpoint at the network edge (e.g., WAF, reverse proxy). This is a temporary measure and does not replace the need to patch. - Post-Compromise Actions: If exploitation is suspected, assume all connected database credentials have been compromised. Immediately rotate all database credentials stored in Metabase, revoke any suspicious session tokens, and conduct a thorough investigation to determine the extent of data access.
- Application Hardening (D3-AH): Restrict access to the Metabase instance to trusted internal networks or require VPN access. Avoid exposing the Metabase login page directly to the public internet if possible.
Timeline of Events
Article Updates
August 12, 2026
CVE-2026-72898 assigned to Metabase SQLi flaw; LexisNexis confirmed as new victim, and a Sigma rule for detection is now available.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Immediately applying the patches provided by Metabase is the most effective way to remediate this vulnerability.
Filter Network Traffic
Restrict access to the Metabase instance from the public internet. If it must be exposed, use a WAF to block malicious requests to the vulnerable endpoint as a temporary measure.
Run Metabase in an isolated environment with strict network egress rules to prevent it from accessing unauthorized internal resources or exfiltrating data, even if compromised.
Timeline of Events
Metabase detects active exploitation of a zero-day against its own cloud platform.
Metabase releases patches for the vulnerability across six different release lines.
Companies including Framework and Tally publicly disclose data breaches stemming from the Metabase exploit.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.