Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Unauthenticated Admin Access

Key facts for Metabase August 2026 Cloud intrusion

Detection coverage for Metabase August 2026 Cloud intrusion

As of 2026-08-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1940 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Metabase reset_password SQLi Admin Session Forgery (GHSA-vwf4-m7j8-wcjf) — SPL

Detects the confirmed two-request exploitation signature for the CVSS 10.0 Metabase zero-day GHSA-vwf4-m7j8-wcjf: an unauthenticated POST to /api/session/reset_password returning HTTP 400 (SQL injection attempt against the unauthenticated password-reset endpoint) immediately followed, from the same source IP, by a GET to /api/user/current returning HTTP 200 — confirming a forged administrator session was established without credentials. Metabase CEO Sameer Al-Sakran publicly stated this exact pattern in application/ingress logs indicates compromise.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002
• Data sources: nginx_access_log, aws_alb_access_log, cloudflare_http_log, metabase_application_log
• Severity: critical
• Confidence: high

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=aws:elb:accesslogs OR sourcetype=cloudflare:http) uri_path="/api/session/reset_password" method=POST status=400
| eval reset_time=_time
| rename clientip AS src_ip
| join type=inner src_ip
    [ search index=web (sourcetype=access_combined OR sourcetype=aws:elb:accesslogs OR sourcetype=cloudflare:http) uri_path="/api/user/current" method=GET status=200
      | eval current_time=_time
      | rename clientip AS src_ip
      | fields src_ip current_time ]
| where current_time > reset_time AND (current_time - reset_time) <= 60
| eval delta_sec=current_time-reset_time
| table src_ip reset_time current_time delta_sec
| sort - reset_time

Microsoft KQL

AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category in ("ApplicationGatewayAccessLog", "ApplicationGatewayFirewallLog") or ResourceType == "APPLICATIONGATEWAYS"
| where requestUri_s has "/api/session/reset_password" and httpMethod_s == "POST" and httpStatus_d == 400
| project ResetTime = TimeGenerated, ClientIP = clientIP_s
| join kind=inner (
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where requestUri_s has "/api/user/current" and httpMethod_s == "GET" and httpStatus_d == 200
    | project CurrentTime = TimeGenerated, ClientIP = clientIP_s
) on ClientIP
| where CurrentTime > ResetTime and CurrentTime - ResetTime <= 1m
| project ClientIP, ResetTime, CurrentTime, DeltaSeconds = datetime_diff('second', CurrentTime, ResetTime)
| sort by ResetTime desc

Sigma

title: Metabase Unauthenticated Password-Reset SQL Injection Probe (GHSA-vwf4-m7j8-wcjf)
id: 7c1e4a2e-5b3d-4f6a-9c2e-1a2b3c4d5e01
status: experimental
description: Detects an unauthenticated POST to the Metabase /api/session/reset_password endpoint returning HTTP 400, the first half of the confirmed exploitation signature for the CVSS 10.0 SQL injection zero-day GHSA-vwf4-m7j8-wcjf. Correlate with a following GET /api/user/current returning HTTP 200 from the same source IP within 60 seconds to confirm a forged administrator session.
references:
  - https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
  - https://www.metabase.com/blog/security-update
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-08
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.002
  - cve.2026.ghsa-vwf4-m7j8-wcjf
logsource:
  category: webserver
detection:
  selection_reset:
    cs-method: POST
    cs-uri-stem|contains: '/api/session/reset_password'
    sc-status: 400
  condition: selection_reset
falsepositives:
  - Legitimate password-reset attempts by users who mistype credentials (will not chain to a successful GET /api/user/current 200 from the same source within 60 seconds)
  - Automated vulnerability scanners probing the endpoint without follow-on session use
level: critical

Known false positives:

• Legitimate users who mistype credentials during a genuine password reset (will not chain to a successful GET /api/user/current 200 from the same source IP within 60 seconds)
• Automated vulnerability scanners probing the endpoint that never follow up with a session-validation request

Tuning notes: Tune the 60-second join/correlation window to match observed proxy clock skew; if fronted by a shared NAT/load balancer, correlate on session cookie or X-Forwarded-For instead of raw clientip to avoid merging distinct users behind the same egress IP.

• 🔒 [indicator] reset_password SQLi Admin Session Forgery (GHSA-vwf4-m7j8-wcjf) — KQL · unlock with TL Creds
• 🔒 [indicator] Post-Compromise Admin API Key Creation & Account Manipulation — KQL · unlock with TL Creds
• 🔒 [indicator] Forged-Session Bulk Data Export via Connected Data Sources — KQL · unlock with TL Creds
• 🔒 [indicator] reset_password SQLi Admin Session Forgery (GHSA-vwf4-m7j8-wcjf) — Sigma · unlock with TL Creds
• 🔒 [indicator] Post-Compromise Admin API Key Creation & Account Manipulation — Sigma · unlock with TL Creds
• 🔒 [indicator] Forged-Session Bulk Data Export via Connected Data Sources — Sigma · unlock with TL Creds
• 🔒 [indicator] Post-Compromise Admin API Key Creation & Account Manipulation — SPL · unlock with TL Creds
• 🔒 [indicator] Forged-Session Bulk Data Export via Connected Data Sources — SPL · unlock with TL Creds

Indicators of compromise for Metabase August 2026 Cloud intrusion

As of 2026-08-08, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-1940.

How Metabase August 2026 Cloud intrusion works

GHSA-vwf4-m7j8-wcjf is a CVSS 10.0 SQL injection vulnerability in Metabase, a widely deployed open-source and cloud business-intelligence/analytics platform. The flaw lives in the unauthenticated password-reset endpoint, /api/session/reset_password: by injecting SQL through this endpoint, a remote attacker with no credentials can manipulate the Metabase application database directly, ultimately forging or obtaining a valid administrator session. Once inside, the attacker can modify application configuration, read and export any data reachable through Metabase's connected data-source integrations, and steal the stored credentials Metabase holds for those connected databases and warehouses. Neither the GHSA advisory, the Metabase vendor blog, nor any of the news coverage that was reviewed publishes the specific SQL injection payload or the vulnerable query construction — the exact injection mechanics inside the endpoint's code are not public.

The vulnerability affects self-hosted Metabase in the 1.58.0 through 1.63.3 release lines (precisely: >=1.58.0,<1.58.24; >=1.59.0,<1.59.21; >=1.60.0,<1.60.17; >=1.61.0,<1.61.11; >=1.62.0,<1.62.9; >=1.63.0,<1.63.5); it is fixed in 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. Version 1.57 and earlier are unaffected. Metabase Cloud instances were patched automatically by the vendor. No CVE has been assigned to the flaw as of publication (confirmed via search of CVE aggregators as of 2026-08-08); it is tracked solely under its GitHub Security Advisory identifier, GHSA-vwf4-m7j8-wcjf.

Metabase confirmed active, in-the-wild exploitation predating its own discovery of the bug: on August 3, 2026, attackers used the flaw against Metabase Cloud instances belonging to Framework (a laptop/PC manufacturer), Tally (an online form-builder SaaS), and LexisNexis (a data/legal-analytics broker, which confirmed its "Metabase API" was impacted and disconnected the affected third-party-hosted systems while investigating, without disclosing full exposure details). This LexisNexis Metabase incident is distinct from and unrelated to LexisNexis's separate, earlier February 2026 AWS/React2Shell breach attributed to the actor FulcrumSec. Framework's exposure covered customer names, email addresses, login IP addresses, billing/shipping addresses, phone numbers, company names, and (for business customers) VAT/EIN and billing email addresses; payment and order data were not touched. Tally's exposure covered user email addresses and one-way password hashes; submitted form content was not accessed. Metabase notified Framework on or around August 6, shipped patches the same day, and disclosed the vulnerability publicly on August 6-7, 2026; Framework emailed all of its customers on August 7 attributing the incident to "an upstream cyberattack at Metabase."

The defining exploitation signature documented by Metabase and corroborating outlets is a two-request pattern in access logs: an unauthenticated POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200 — the latter confirming a successfully hijacked administrator session. Metabase CEO Sameer Al-Sakran told reporters: "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised." Metabase's incident-response guidance for potentially compromised instances is to purge the core_session table, review and delete unrecognized API keys (indicating attackers may mint new API keys as a persistence mechanism after forging admin access), audit administrator accounts for unauthorized changes/creation, rotate credentials for every database connected to Metabase, and review data-warehouse and Metabase query/access logs for signs of prior exploitation. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-08 (unrelated older Metabase entry CVE-2021-41277, a GeoJSON API local-file-inclusion flaw, is already KEV-listed but is a separate, prior vulnerability).

This is not Metabase's first maximum-impact unauthenticated flaw: CVE-2023-38646 (CVSS 9.8), a pre-authentication remote-code-execution bug rooted in a SQL injection against Metabase's H2 JDBC driver via the /api/setup/validate endpoint, was patched in July 2023 after roughly 20,000 internet-exposed instances were identified by researchers. GHSA-vwf4-m7j8-wcjf repeats the pattern of an unauthenticated endpoint reachable pre-login providing a path to full SQL injection and administrative compromise, this time exploited as a genuine zero-day before any public advisory existed, and — with at least three confirmed, independent Metabase Cloud tenants (Framework, Tally, LexisNexis) hit in the same narrow pre-disclosure window — consistent with attackers having systematically identified and targeted multiple internet-exposed/hosted Metabase instances rather than exploiting a single known target.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1078.004 Cloud Accounts

Discovery

T1087.004 Cloud Account

Persistence

T1098.001 Additional Cloud Credentials

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

lateral-movement

T1550.004 Web Session Cookie

Credential Access

T1552 Unsecured Credentials

Impact

T1565.001 Stored Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for Metabase August 2026 Cloud intrusion

Patches

• Metabase 1.58.24
• Metabase 1.59.21
• Metabase 1.60.17
• Metabase 1.61.11
• Metabase 1.62.9
• Metabase 1.63.5

Immediate actions

• Upgrade Metabase to a patched release: 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5, matching your current branch
• If immediate upgrade is not possible, block public access to the /api/session/reset_password endpoint at the perimeter or reverse proxy
• Purge all rows from the core_session table to invalidate any attacker-forged administrator sessions

Workarounds

• Block or restrict access to /api/session/reset_password until patched
• Metabase Cloud instances were patched automatically by the vendor and require no customer action beyond post-incident credential rotation

Longer-term hardening

• Review and delete unrecognized or unauthorized Metabase API keys
• Audit administrator accounts for unauthorized creation or modification
• Rotate credentials for every database and data warehouse connected to Metabase
• Review data-warehouse and Metabase query/access logs for evidence of prior exploitation or data export
• Monitor access logs for the POST /api/session/reset_password (400) followed by GET /api/user/current (200) signature

Affected and fixed versions

• Metabase — Metabase (self-hosted and Metabase Cloud)
  Vulnerable versions: >=1.58.0,<1.58.24; >=1.59.0,<1.59.21; >=1.60.0,<1.60.17; >=1.61.0,<1.61.11; >=1.62.0,<1.62.9; >=1.63.0,<1.63.3
  Fixed in: 1.58.24; 1.59.21; 1.60.17; 1.61.11; 1.62.9; 1.63.5

Timeline of Metabase August 2026 Cloud intrusion

• 2023-07-21 locked-ioc-7 patches CVE-2023-38646 (CVSS 9.8), a pre-auth RCE via SQL injection in the H2 JDBC driver reachable through /api/setup/validate, after roughly 20,000 internet-exposed instances were identified — the vulnerability-class precedent for this 2026 zero-day.
• 2026-08-03 Attackers exploit the then-unknown GHSA-vwf4-m7j8-wcjf SQL injection flaw against locked-ioc-3 instances belonging to locked-ioc-6, locked-ioc-8, and locked-ioc-5.
• 2026-08-06 locked-ioc-7 ships patched releases across all affected branches (1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, 1.63.5); locked-ioc-3 instances are patched automatically.
• 2026-08-06 locked-ioc-7 publishes its 'Security Update' blog post and GitHub publishes the GHSA-vwf4-m7j8-wcjf security advisory disclosing the unauthenticated SQL injection flaw.
• 2026-08-06 locked-ioc-7 notifies locked-ioc-6 that its locked-ioc-3 instance was compromised via the zero-day.
• 2026-08-07 locked-ioc-5 confirms its 'locked-ioc-7 API' was impacted by the incident and disconnects the affected third-party-hosted systems while investigating; this is a separate incident from locked-ioc-5's earlier February 2026 AWS/React2Shell breach.
• 2026-08-07 locked-ioc-8 confirms exposure of user email addresses and one-way password hashes; forms and submitted answers were not accessed.
• 2026-08-07 locked-ioc-6 emails all customers disclosing the breach, attributing it to 'an upstream cyberattack at locked-ioc-7'; names, emails, phone numbers, and addresses were exposed but payment data was not.
• 2026-08-08 locked-ioc-7 CEO Sameer Al-Sakran publicly states that finding the POST locked-ioc-1 (400) followed by GET locked-ioc-2 (200) pattern in application or ingress logs indicates a compromised instance.
• 2026-08-08 The Hacker News, BleepingComputer, Security Affairs, and other outlets report confirmed active in-the-wild exploitation and publish the reset_password/user-current attack signature for defenders.

Sources cited for Metabase August 2026 Cloud intrusion

• Metabase Security Update metabase.com · Vendor report · 2026-08-06
• CVE-2023-38646 (prior Metabase pre-auth RCE via SQL injection) Wiz · Research · 2023-07-21
• SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf) GitHub · Code repository · 2026-08-06
• Metabase Zero-Day Exploited in Wild for Unauthenticated Admin Access The Hacker News · News · 2026-08-08
• Metabase SQLi zero-day exploited in customer data-theft attacks BleepingComputer · News · 2026-08-07
• Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data securityaffairs.com · News · 2026-08-08
• Metabase zero-day: Data leak at laptop manufacturer Framework heise.de · News · 2026-08-07
• Computer maker Framework notifies 'all customers' of a data breach techcrunch.com · News · 2026-08-07

Threats related to Metabase August 2026 Cloud intrusion

• Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) Exploited In the Wild for Admin Access
• Critical Metabase Zero-Day (CVE-2026-72898): Unauthenticated SQL Injection Grants Admin Access, Exploited in the Wild
• Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover
• Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf): Unauthenticated SQL Injection via /api/session/reset_password Exploited to Steal Database Credentials
• Metabase Unauthenticated SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) Exploited to Steal Connected Database Credentials

Related coverage of this activity

• Metabase breach Framework Tally data
• Metabase Framework Tally breach
• CosmosEscape Cosmos DB RCE
• CVE-2026-69836 Entra ID RCE
• Cisco Secure Workload auth bypass