# Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Unauthenticated Admin Access

> A maximum-severity (CVSS 10.0) zero-day in Metabase's /api/session/reset_password endpoint let unauthenticated remote attackers inject arbitrary SQL and forge administrator sessions. Attackers exploited it in the wild against Metabase Cloud on August 3, 2026, breaching PC maker Framework, form-builder Tally, and data broker LexisNexis before Metabase publicly disclosed and patched the flaw on August 6-7, 2026.

- **Published:** 2026-08-08T00:00:00Z
- **Last reviewed:** 2026-08-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1940
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-metabase-august-2026-cloud-intrusion-tl-2026-1940.webp?v=1bbeb9f9 (Threadlinqs threat intel: GHSA-vwf4-m7j8-wcjf Metabase Cloud Breach Hits Framework (TL-2026-1940) — Critical severity, 9 IOCs, 9 detection rules.)
- **ID:** TL-2026-1940
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

GHSA-vwf4-m7j8-wcjf is a CVSS 10.0 SQL injection vulnerability in Metabase, a widely deployed open-source and cloud business-intelligence/analytics platform. The flaw lives in the unauthenticated password-reset endpoint, /api/session/reset_password: by injecting SQL through this endpoint, a remote attacker with no credentials can manipulate the Metabase application database directly, ultimately forging or obtaining a valid administrator session. Once inside, the attacker can modify application configuration, read and export any data reachable through Metabase's connected data-source integrations, and steal the stored credentials Metabase holds for those connected databases and warehouses. Neither the GHSA advisory, the Metabase vendor blog, nor any of the news coverage that was reviewed publishes the specific SQL injection payload or the vulnerable query construction — the exact injection mechanics inside the endpoint's code are not public.

The vulnerability affects self-hosted Metabase in the 1.58.0 through 1.63.3 release lines (precisely: >=1.58.0,<1.58.24; >=1.59.0,<1.59.21; >=1.60.0,<1.60.17; >=1.61.0,<1.61.11; >=1.62.0,<1.62.9; >=1.63.0,<1.63.5); it is fixed in 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. Version 1.57 and earlier are unaffected. Metabase Cloud instances were patched automatically by the vendor. No CVE has been assigned to the flaw as of publication (confirmed via search of CVE aggregators as of 2026-08-08); it is tracked solely under its GitHub Security Advisory identifier, GHSA-vwf4-m7j8-wcjf.

Metabase confirmed active, in-the-wild exploitation predating its own discovery of the bug: on August 3, 2026, attackers used the flaw against Metabase Cloud instances belonging to Framework (a laptop/PC manufacturer), Tally (an online form-builder SaaS), and LexisNexis (a data/legal-analytics broker, which confirmed its "Metabase API" was impacted and disconnected the affected third-party-hosted systems while investigating, without disclosing full exposure details). This LexisNexis Metabase incident is distinct from and unrelated to LexisNexis's separate, earlier February 2026 AWS/React2Shell breach attributed to the actor FulcrumSec. Framework's exposure covered customer names, email addresses, login IP addresses, billing/shipping addresses, phone numbers, company names, and (for business customers) VAT/EIN and billing email addresses; payment and order data were not touched. Tally's exposure covered user email addresses and one-way password hashes; submitted form content was not accessed. Metabase notified Framework on or around August 6, shipped patches the same day, and disclosed the vulnerability publicly on August 6-7, 2026; Framework emailed all of its customers on August 7 attributing the incident to "an upstream cyberattack at Metabase."

The defining exploitation signature documented by Metabase and corroborating outlets is a two-request pattern in access logs: an unauthenticated POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200 — the latter confirming a successfully hijacked administrator session. Metabase CEO Sameer Al-Sakran told reporters: "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised." Metabase's incident-response guidance for potentially compromised instances is to purge the core_session table, review and delete unrecognized API keys (indicating attackers may mint new API keys as a persistence mechanism after forging admin access), audit administrator accounts for unauthorized changes/creation, rotate credentials for every database connected to Metabase, and review data-warehouse and Metabase query/access logs for signs of prior exploitation. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-08 (unrelated older Metabase entry CVE-2021-41277, a GeoJSON API local-file-inclusion flaw, is already KEV-listed but is a separate, prior vulnerability).

This is not Metabase's first maximum-impact unauthenticated flaw: CVE-2023-38646 (CVSS 9.8), a pre-authentication remote-code-execution bug rooted in a SQL injection against Metabase's H2 JDBC driver via the /api/setup/validate endpoint, was patched in July 2023 after roughly 20,000 internet-exposed instances were identified by researchers. GHSA-vwf4-m7j8-wcjf repeats the pattern of an unauthenticated endpoint reachable pre-login providing a path to full SQL injection and administrative compromise, this time exploited as a genuine zero-day before any public advisory existed, and — with at least three confirmed, independent Metabase Cloud tenants (Framework, Tally, LexisNexis) hit in the same narrow pre-disclosure window — consistent with attackers having systematically identified and targeted multiple internet-exposed/hosted Metabase instances rather than exploiting a single known target.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1550.004 Web Session Cookie
- T1078.004 Cloud Accounts
- T1087.004 Cloud Account
- T1552 Unsecured Credentials
- T1098.001 Additional Cloud Credentials
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1565.001 Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Metabase reset_password SQLi Admin Session Forgery (GHSA-vwf4-m7j8-wcjf) — SPL** (`TL-2026-1940-SPL-001`)

Detects the confirmed two-request exploitation signature for the CVSS 10.0 Metabase zero-day GHSA-vwf4-m7j8-wcjf: an unauthenticated POST to /api/session/reset_password returning HTTP 400 (SQL injection attempt against the unauthenticated password-reset endpoint) immediately followed, from the same source IP, by a GET to /api/user/current returning HTTP 200 — confirming a forged administrator session was established without credentials. Metabase CEO Sameer Al-Sakran publicly stated this exact pattern in application/ingress logs indicates compromise.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.002
- **Data sources:** nginx_access_log, aws_alb_access_log, cloudflare_http_log, metabase_application_log
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web (sourcetype=access_combined OR sourcetype=aws:elb:accesslogs OR sourcetype=cloudflare:http) uri_path="/api/session/reset_password" method=POST status=400
| eval reset_time=_time
| rename clientip AS src_ip
| join type=inner src_ip
    [ search index=web (sourcetype=access_combined OR sourcetype=aws:elb:accesslogs OR sourcetype=cloudflare:http) uri_path="/api/user/current" method=GET status=200
      | eval current_time=_time
      | rename clientip AS src_ip
      | fields src_ip current_time ]
| where current_time > reset_time AND (current_time - reset_time) <= 60
| eval delta_sec=current_time-reset_time
| table src_ip reset_time current_time delta_sec
| sort - reset_time
```

### Microsoft KQL

```kql
AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category in ("ApplicationGatewayAccessLog", "ApplicationGatewayFirewallLog") or ResourceType == "APPLICATIONGATEWAYS"
| where requestUri_s has "/api/session/reset_password" and httpMethod_s == "POST" and httpStatus_d == 400
| project ResetTime = TimeGenerated, ClientIP = clientIP_s
| join kind=inner (
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where requestUri_s has "/api/user/current" and httpMethod_s == "GET" and httpStatus_d == 200
    | project CurrentTime = TimeGenerated, ClientIP = clientIP_s
) on ClientIP
| where CurrentTime > ResetTime and CurrentTime - ResetTime <= 1m
| project ClientIP, ResetTime, CurrentTime, DeltaSeconds = datetime_diff('second', CurrentTime, ResetTime)
| sort by ResetTime desc
```

### Sigma

```yaml
title: Metabase Unauthenticated Password-Reset SQL Injection Probe (GHSA-vwf4-m7j8-wcjf)
id: 7c1e4a2e-5b3d-4f6a-9c2e-1a2b3c4d5e01
status: experimental
description: Detects an unauthenticated POST to the Metabase /api/session/reset_password endpoint returning HTTP 400, the first half of the confirmed exploitation signature for the CVSS 10.0 SQL injection zero-day GHSA-vwf4-m7j8-wcjf. Correlate with a following GET /api/user/current returning HTTP 200 from the same source IP within 60 seconds to confirm a forged administrator session.
references:
  - https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
  - https://www.metabase.com/blog/security-update
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-08
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.002
  - cve.2026.ghsa-vwf4-m7j8-wcjf
logsource:
  category: webserver
detection:
  selection_reset:
    cs-method: POST
    cs-uri-stem|contains: '/api/session/reset_password'
    sc-status: 400
  condition: selection_reset
falsepositives:
  - Legitimate password-reset attempts by users who mistype credentials (will not chain to a successful GET /api/user/current 200 from the same source within 60 seconds)
  - Automated vulnerability scanners probing the endpoint without follow-on session use
level: critical
```

**Known false positives:**

- Legitimate users who mistype credentials during a genuine password reset (will not chain to a successful GET /api/user/current 200 from the same source IP within 60 seconds)
- Automated vulnerability scanners probing the endpoint that never follow up with a session-validation request

**Tuning notes:** Tune the 60-second join/correlation window to match observed proxy clock skew; if fronted by a shared NAT/load balancer, correlate on session cookie or X-Forwarded-For instead of raw clientip to avoid merging distinct users behind the same egress IP.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] reset_password SQLi Admin Session Forgery (GHSA-vwf4-m7j8-wcjf) — KQL (locked: unlock with TL Creds)
- [indicator] Post-Compromise Admin API Key Creation & Account Manipulation — KQL (locked: unlock with TL Creds)
- [indicator] Forged-Session Bulk Data Export via Connected Data Sources — KQL (locked: unlock with TL Creds)
- [indicator] reset_password SQLi Admin Session Forgery (GHSA-vwf4-m7j8-wcjf) — Sigma (locked: unlock with TL Creds)
- [indicator] Post-Compromise Admin API Key Creation & Account Manipulation — Sigma (locked: unlock with TL Creds)
- [indicator] Forged-Session Bulk Data Export via Connected Data Sources — Sigma (locked: unlock with TL Creds)
- [indicator] Post-Compromise Admin API Key Creation & Account Manipulation — SPL (locked: unlock with TL Creds)
- [indicator] Forged-Session Bulk Data Export via Connected Data Sources — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Metabase Security Update](https://www.metabase.com/blog/security-update)
- [SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Metabase Zero-Day Exploited in Wild for Unauthenticated Admin Access](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [Metabase SQLi zero-day exploited in customer data-theft attacks](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)
- [Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data](https://securityaffairs.com/196874/hacking/metabase-zero-day-exploited-in-the-wild-exposing-admin-access-and-sensitive-data.html)
- [Metabase zero-day: Data leak at laptop manufacturer Framework](https://www.heise.de/en/news/Metabase-zero-day-Data-leak-at-laptop-manufacturer-Framework-11403251.html)
- [Computer maker Framework notifies 'all customers' of a data breach](https://techcrunch.com/2026/08/07/computer-maker-framework-notifies-all-customers-of-a-data-breach/)
- [CVE-2023-38646 (prior Metabase pre-auth RCE via SQL injection)](https://www.wiz.io/vulnerability-database/cve/cve-2023-38646)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1940