Metabase Zero-Day (CVSS 10.0): SQL Injection Explained

A single unauthenticated request has turned one of the most widely deployed open-source analytics tools into a pathway to the databases behind it. Metabase, the business-intelligence platform, has disclosed a maximum-severity zero-day — tracked as GHSA-vwf4-m7j8-wcjf and rated CVSS 10.0 — that attackers exploited in the wild to gain administrator access and steal the credentials for every database an affected instance was connected to. On August 6, 2026, Metabase confirmed that the flaw had already been used against its own Metabase Cloud infrastructure, and multiple companies have since traced customer-data breaches back to it.

The severity is not an exaggeration of scale. A CVSS 10.0 is reserved for the worst class of vulnerability — unauthenticated, remotely exploitable, and total in its impact — and this one earns all three. The bug turns a public-facing analytics dashboard into a credential vault that hands over the keys to whatever data the organization plugged into it.

The vulnerability

The flaw is an unauthenticated SQL injection in the POST /api/session/reset_password endpoint — the same endpoint a legitimate user hits to begin a password reset. Because the endpoint is reachable without any credentials, an attacker needs nothing more than network access to the Metabase instance. By sending crafted input to that endpoint, they can inject arbitrary SQL into Metabase’s own application database.

From there the escalation is direct. Injecting SQL against the application database lets the attacker grant themselves full administrator access to the Metabase instance. Admin access, in turn, exposes the stored connection details for every data source the instance queries — because a BI tool’s entire job is to hold live credentials for the databases it reports on. The attacker can then harvest those credentials, read any data reachable through them, and export it in bulk, alter application configuration, and pivot outward into the connected systems.

It is a textbook illustration of why unauthenticated input-handling bugs sit at the top of the OWASP risk hierarchy: no login, no user interaction, and a payload that reaches straight into the database layer.

Who is affected

The vulnerability affects every Metabase release from version 1.58 onward, spanning the 0.58 through 0.63 branches, in both the self-hosted editions and Metabase’s own hosted cloud. That is a wide blast radius for a tool that thousands of organizations run as an internet-facing dashboard.

One detail sharpens the exposure: at the time of disclosure, no CVE identifier had been assigned to the flaw, which was published only under its GitHub Security Advisory ID. Vulnerability scanners and monitoring pipelines that key off the National Vulnerability Database feed would therefore not have flagged an exposed instance — a blind spot that let vulnerable deployments sit unnoticed even after the advisory went out.

Exploited in the wild

This was not a theoretical disclosure. Metabase said the endpoint was weaponized as a zero-day — exploited before a patch existed — and that the activity targeted Metabase Cloud beginning in early August. Security researchers who analyzed the attacks described a clean, repeatable chain: hit the password-reset endpoint, inject, escalate to admin, dump connection credentials, exfiltrate.

The downstream damage has surfaced through the companies that use Metabase. Framework, the modular-laptop maker, and Tally, the form-building platform, both traced customer-data exposure back to the Metabase flaw. The exposed records reportedly included names, email addresses, physical addresses, phone numbers, and company details — the kind of contact and account data that fuels follow-on phishing and fraud. The pattern echoes the recent Oracle PeopleSoft campaign, in which a single unauthenticated enterprise-software bug cascaded into breaches at scores of downstream organizations.

The fix and the response

Metabase has shipped patched builds across every affected branch. The fixed releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 (and their Enterprise equivalents). The company’s guidance is unambiguous: self-hosted operators should update to a fixed version immediately, and treat any unpatched, internet-reachable instance as potentially already compromised.

Alongside the patch, Metabase said it blocked the endpoints used in the attack on its cloud infrastructure, notified law enforcement, and engaged a third-party forensics firm to investigate the intrusion. For self-hosted users, patching is only the first step. Because the exploit’s payoff is stolen database credentials, any organization that ran a vulnerable version while it was internet-facing should assume those credentials may have been captured and rotate every secret the instance held — the database passwords, API keys, and connection strings for each linked data source — not merely upgrade the software.

How to tell whether you were hit

Because the exploit runs through a legitimate endpoint, the traces it leaves are subtle. Defenders investigating a potentially exposed instance should start with the web-server and Metabase access logs, looking for anomalous POST requests to /api/session/reset_password — particularly bursts of them, requests carrying unusually long or malformed bodies, or traffic to that path from IPs that never legitimately reset a password. Unexpected new administrator accounts, changes to configured data-source connections, or admin logins from unfamiliar addresses are stronger indicators that injection succeeded and escalated.

The harder problem is what happens after admin access: the attacker’s goal was to read out stored connection credentials, an action that looks, from the application’s perspective, like normal privileged use. That is why the connected databases’ own logs matter as much as Metabase’s — a spike in queries or bulk reads from the account Metabase uses to reach a data source, during the exposure window, is often the clearest evidence that data was actually exfiltrated rather than merely reachable.

What it means

BI tools are high-value targets precisely because they aggregate access. The reason a Metabase compromise is so damaging is structural: an analytics platform’s function is to hold live credentials for many databases at once, so breaching it yields not one system but all of them. That makes tools like this a credential concentrator — a single box whose compromise collapses the blast radius of an entire data estate into one request. Any internet-facing service that federates access to backend data deserves the same scrutiny an organization gives its identity provider, and rarely gets it.

The missing CVE is the quiet lesson. A CVSS 10.0 published only as a GitHub advisory, with no NVD-backed CVE at disclosure, is invisible to scanners that watch the NVD feed alone. Defenders who rely on a single vulnerability source for their alerting were, for a window, exposed to a maximum-severity bug their tooling could not see. The takeaway is to watch vendor advisories and GitHub Security Advisories directly, not to wait for a CVE number to propagate — because attackers exploiting a zero-day are not waiting for it either.

Patching is necessary and insufficient. The instinct after a disclosure like this is to upgrade and move on, but the payload here was credential theft, and stolen credentials survive the patch. An organization that fixed the software without rotating the secrets the instance exposed may have closed the door while leaving the keys outside. Incident response for a credential-exfiltration bug has to assume the credentials are gone: rotate first, then verify what the connected databases logged during the exposure window.

The self-hosted long tail is where the damage lingers. Metabase can block endpoints and rotate keys across its own cloud in hours; the thousands of self-managed, internet-facing instances running old versions cannot be reached that way. History with mass-exploited enterprise software says the initial victims are only the leading edge — the flaw will keep producing breaches for months as unpatched deployments are found and picked off. For defenders, the urgent action is not to track how the story develops but to check, today, whether an exposed Metabase instance is sitting on the perimeter with live database credentials behind it.