GHSA-vwf4-m7j8-wcjf is a CVSS 10.0 SQL injection vulnerability in Metabase, a widely deployed open-source and cloud business-intelligence/analytics platform. The flaw lives in the unauthenticated password-reset endpoint, /api/session/reset_password: by injecting SQL through this endpoint, a remote attacker with no credentials can manipulate the Metabase application database directly, ultimately forging or obtaining a valid administrator session. Once inside, the attacker can modify application configuration, read and export any data reachable through Metabase's connected data-source integrations, and steal the stored credentials Metabase holds for those connected databases and warehouses. Neither the GHSA advisory, the Metabase vendor blog, nor any of the news coverage that was reviewed publishes the specific SQL injection payload or the vulnerable query construction — the exact injection mechanics inside the endpoint's code are not public.

The vulnerability affects self-hosted Metabase in the 1.58.0 through 1.63.3 release lines (precisely: >=1.58.0,<1.58.24; >=1.59.0,<1.59.21; >=1.60.0,<1.60.17; >=1.61.0,<1.61.11; >=1.62.0,<1.62.9; >=1.63.0,<1.63.5); it is fixed in 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. Version 1.57 and earlier are unaffected. Metabase Cloud instances were patched automatically by the vendor. No CVE has been assigned to the flaw as of publication (confirmed via search of CVE aggregators as of 2026-08-08); it is tracked solely under its GitHub Security Advisory identifier, GHSA-vwf4-m7j8-wcjf.

Metabase confirmed active, in-the-wild exploitation predating its own discovery of the bug: on August 3, 2026, attackers used the flaw against Metabase Cloud instances belonging to Framework (a laptop/PC manufacturer), Tally (an online form-builder SaaS), and LexisNexis (a data/legal-analytics broker, which confirmed its "Metabase API" was impacted and disconnected the affected third-party-hosted systems while investigating, without disclosing full exposure details). This LexisNexis Metabase incident is distinct from and unrelated to LexisNexis's separate, earlier February 2026 AWS/React2Shell breach attributed to the actor FulcrumSec. Framework's exposure covered customer names, email addresses, login IP addresses, billing/shipping addresses, phone numbers, company names, and (for business customers) VAT/EIN and billing email addresses; payment and order data were not touched. Tally's exposure covered user email addresses and one-way password hashes; submitted form content was not accessed. Metabase notified Framework on or around August 6, shipped patches the same day, and disclosed the vulnerability publicly on August 6-7, 2026; Framework emailed all of its customers on August 7 attributing the incident to "an upstream cyberattack at Metabase."

The defining exploitation signature documented by Metabase and corroborating outlets is a two-request pattern in access logs: an unauthenticated POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200 — the latter confirming a successfully hijacked administrator session. Metabase CEO Sameer Al-Sakran told reporters: "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised." Metabase's incident-response guidance for potentially compromised instances is to purge the core_session table, review and delete unrecognized API keys (indicating attackers may mint new API keys as a persistence mechanism after forging admin access), audit administrator accounts for unauthorized changes/creation, rotate credentials for every database connected to Metabase, and review data-warehouse and Metabase query/access logs for signs of prior exploitation. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-08 (unrelated older Metabase entry CVE-2021-41277, a GeoJSON API local-file-inclusion flaw, is already KEV-listed but is a separate, prior vulnerability).

This is not Metabase's first maximum-impact unauthenticated flaw: CVE-2023-38646 (CVSS 9.8), a pre-authentication remote-code-execution bug rooted in a SQL injection against Metabase's H2 JDBC driver via the /api/setup/validate endpoint, was patched in July 2023 after roughly 20,000 internet-exposed instances were identified by researchers. GHSA-vwf4-m7j8-wcjf repeats the pattern of an unauthenticated endpoint reachable pre-login providing a path to full SQL injection and administrative compromise, this time exploited as a genuine zero-day before any public advisory existed, and — with at least three confirmed, independent Metabase Cloud tenants (Framework, Tally, LexisNexis) hit in the same narrow pre-disclosure window — consistent with attackers having systematically identified and targeted multiple internet-exposed/hosted Metabase instances rather than exploiting a single known target.