CRITICAL Vulnerabilities #SQL Injection #Zero-Day #Data Breach

Metabase SQLi Zero-Day Exploited: Data Theft Attacks Confirmed

2026-08-08 00:54 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Metabase Cloud and self-hosted instances are compromised via a critical SQL injection zero-day, leading to customer data theft.
Affected systems include Metabase versions 1.58 and above, including 0.58.x through 0.63.x branches.
Immediately upgrade self-hosted Metabase instances to patched versions and follow post-compromise remediation steps.

A critical, unauthenticated SQL injection zero-day vulnerability in Metabase, affecting versions 1.58 and above, has been actively exploited in the wild, leading to data theft from customer instances. Metabase, a popular open-source business intelligence platform, disclosed the attacks, confirming that its Metabase Cloud SaaS platform was compromised. Self-hosted installations are also vulnerable if not updated, posing a significant risk to organizations utilizing the platform, according to BleepingComputer.

Metabase has identified and blocked the attack endpoints, subsequently rolling out a fix for the vulnerability. This unauthenticated SQL injection flaw allows a remote attacker to gain administrator access to a customer’s Metabase instance. With administrative control, attackers can alter application configurations, steal stored credentials for connected databases, access any data available through those connections, and export sensitive information.

Technical Details of the Metabase SQLi Zero-Day Vulnerability

The zero-day, described by Metabase as a ‘CRITICAL’ vulnerability with a CVSS score of 10.0, enables attackers to inject arbitrary SQL into the Metabase application database. This critical flaw grants immediate administrative access without requiring any prior authentication. The broad capabilities afforded by this access include:

Configuration Manipulation: Attackers can modify Metabase application settings.
Credential Theft: Stored credentials for any connected databases can be exfiltrated.
Data Exfiltration: Any data accessible via database connections can be read and exported.

The exploitation of this vulnerability has already impacted several organizations. Laptop manufacturer Framework confirmed that its Metabase instance was compromised on August 3, leading to the theft of customer information. This data included full names, email addresses, login IP addresses, billing and shipping address information, phone numbers, and company names. For Framework for Business customers, additional data such as VAT, EIN, and billing email addresses may also have been exposed.

Online form builder Tally also reported a compromise of its Metabase analytics environment on August 3. Attackers accessed email addresses and cryptographic hashes of user passwords. Tally clarified that user forms and submitted answers, stored separately, were not affected. LexisNexis, while not explicitly linking its incident to this specific Metabase API vulnerability, confirmed that its Metabase API was impacted by a cyberattack on a third-party vendor earlier this week, causing service disruptions.

Metabase states that all its Cloud customers have been automatically upgraded and patched. However, organizations running self-hosted Metabase instances must perform manual updates to secure their systems against this active threat.

Mitigation and Remediation for Metabase 1.58+ Unauthenticated SQL Injection

Given the active exploitation and critical nature of this vulnerability, immediate action is paramount for all self-hosted Metabase users. The following steps are crucial for Metabase 1.58+ unauthenticated SQL injection remediation:

Immediate Upgrade: Update all vulnerable Metabase installations to the patched versions. The minimum safe releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5.
Temporary Workaround: If immediate upgrading is not possible, temporarily block access to the /api/session/reset_password endpoint. This serves as a critical, albeit temporary, measure to prevent exploitation.
Post-Compromise Actions: For any potentially compromised instances, Metabase strongly recommends:
- Revoking all active user sessions.
- Reviewing API keys and administrator accounts for any unauthorized changes.
- Rotating credentials for all connected databases.
- Inspecting application logs and query history for signs of compromise.

How to Detect Metabase Data Theft Compromise

Organizations should actively look for indicators of compromise (IOCs) in their system logs to detect Metabase data theft compromise. Attacks can be identified by a POST request to /api/session/reset_password returning a 400 status code, immediately followed by a successful GET request to /api/user/current. The presence of these entries in system logs strongly suggests that an instance has been compromised, and a full forensic investigation should be initiated immediately.

#SQL Injection #Zero-Day #Data Breach

X/Twitter LinkedIn Reddit HN

← Back to Articles