Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) Exploited In the Wild for Admin Access
Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) (TL-2026-1946), also tracked as GHSA-vwf4-m7j8-wcjf, is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-08. It has no confirmed attribution, affects Metabase, Inc. Metabase (Open Source), maps to 9 MITRE ATT&CK techniques (T1078.004, T1087, T1098), and is covered by 9 detection rules and 9 indicators of compromise.
Key facts for TL-2026-1946
- Threat ID
- TL-2026-1946
- Also known as
- GHSA-vwf4-m7j8-wcjf
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-08
- Last reviewed
- 2026-08-08
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, consumer electronics, software-as-a-service, business intelligence and analytics, legal and professional services
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 9
An unauthenticated, CVSS 10.0 SQL injection zero-day in the Metabase business-intelligence platform (GHSA-vwf4-m7j8-wcjf), reachable through the unauthenticated POST /api/session/reset_password endpoint, let attackers escalate straight to administrator access, steal credentials for every database connected to the instance, and exfiltrate data. Metabase discovered the flaw only after its own Metabase Cloud SaaS was compromised on 2026-08-03; downstream customers Framework and Tally have confirmed data theft, and LexisNexis disclosed a related Metabase-linked service disruption.
How Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) works
On 2026-08-06 Metabase, Inc. published GitHub Security Advisory GHSA-vwf4-m7j8-wcjf disclosing a maximum-severity (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) unauthenticated SQL injection vulnerability in the Metabase application. The flaw is reachable through the unauthenticated POST /api/session/reset_password endpoint, which the vendor's own attack signature describes as returning an HTTP 400 status code when abused, immediately followed by a successful GET /api/user/current call returning HTTP 200 -- indicating the attacker obtained a valid, authenticated (administrator-capable) session without ever supplying credentials. No CVE identifier has been assigned as of publication; the flaw is tracked solely via the GitHub Security Advisory.
Metabase became aware of the vulnerability not through internal testing but because it was already being exploited against Metabase's own multi-tenant Metabase Cloud SaaS platform, making this a genuine zero-day: real-world attackers found and weaponized the bug before the vendor did. With the session obtained through the injection, an attacker gains full administrator capability inside the Metabase instance: modifying application configuration, reading the credentials Metabase stores for every connected data source (databases, warehouses, and other backends), running arbitrary queries against those connections, and exporting the results. Because Metabase is a BI/analytics layer that sits in front of a customer's actual production and warehouse data, compromising the Metabase layer functions as a trusted-relationship pivot into whatever data those connections expose -- without the attacker ever touching the customer's own infrastructure directly.
The vulnerability affects self-hosted open-source Metabase 0.58.0 through 0.63.3 and the corresponding Enterprise Edition releases 1.58.0 through 1.63.3 (versions 0.57/1.57 and earlier are unaffected); it is fixed in 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 (and the matching 1.x Enterprise builds). Metabase Cloud instances were patched by the vendor before the public advisory; self-hosted instances required (and in many cases still require) a manual upgrade, and several hosting providers, including Clever Cloud, deployed automatic edge blocking of the reset_password endpoint for at-risk customers as an interim mitigation.
Metabase notified affected Cloud customer Framework (a PC/laptop manufacturer) on 2026-08-06 that its instance had been vulnerable and was accessed by the attacker on 2026-08-03. Framework notified 'all customers' within roughly six hours of learning of the breach; exposed data included customer names, email addresses, login IP addresses, billing/shipping addresses, and phone numbers (and, for Framework for Business accounts, company name, VAT/EIN, and billing email address). Payment and order data were reportedly untouched, and Framework stated it found no evidence of changes to admin access or to systems outside of Metabase. Tally, a form-builder SaaS, separately disclosed that an attacker accessed customer email addresses and one-way password hashes through a compromised Metabase analytics environment (form and submission data were reported unaffected). LexisNexis also disclosed unusual activity affecting third-party-hosted systems including a Metabase API, and disconnected the affected environment pending a forensic investigation; the scope of any data exposure there remains unconfirmed. Metabase has engaged a third-party forensic firm and describes its findings as preliminary. This is not Metabase's first critical pre-authentication flaw: the vendor previously patched CVE-2023-38646 (CVSS 9.8), a pre-auth remote code execution vulnerability, in 2023.
MITRE ATT&CK techniques used in TL-2026-1946
Privilege Escalation
Discovery
Persistence
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Collection
T1213 Data from Information Repositories
lateral-movement
Credential Access
Exfiltration
Affected products and versions in Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf)
- Metabase, Inc. — Metabase (Open Source)
Vulnerable versions: 0.58.0-0.58.23; 0.59.0-0.59.20; 0.60.0-0.60.16; 0.61.0-0.61.10; 0.62.0-0.62.8; 0.63.0-0.63.3
Fixed in: 0.58.24; 0.59.21; 0.60.17; 0.61.11; 0.62.9; 0.63.5 - Metabase, Inc. — Metabase Enterprise Edition
Vulnerable versions: 1.58.0-1.58.23; 1.59.0-1.59.20; 1.60.0-1.60.16; 1.61.0-1.61.10; 1.62.0-1.62.8; 1.63.0-1.63.3
Fixed in: 1.58.24; 1.59.21; 1.60.17; 1.61.11; 1.62.9; 1.63.5
Remediation for Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf)
Patches
- 0.58.24
- 0.59.21
- 0.60.17
- 0.61.11
- 0.62.9
- 0.63.5
- 1.58.24 (Enterprise Edition)
- 1.59.21 (Enterprise Edition)
- 1.60.17 (Enterprise Edition)
- 1.61.11 (Enterprise Edition)
Immediate actions
- Upgrade self-hosted Metabase immediately to a patched build: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (open source), or the matching 1.58.24/1.59.21/1.60.17/1.61.11/1.62.9/1.63.5 Enterprise Edition build
- Until patched, block or deny all requests to POST /api/session/reset_password at a reverse proxy, load balancer, or WAF
- Delete all rows from the Metabase core_session table to invalidate any sessions an attacker may already hold
Workarounds
- Temporarily block or deny all requests to /api/session/reset_password at the network/WAF/reverse-proxy layer until the instance is upgraded to a patched build
Longer-term hardening
- Audit administrator accounts and API keys for entries the organization did not create, and revoke any unrecognized ones
- Rotate credentials for every database, warehouse, or data source connected to the Metabase instance
- Review Metabase query history and the access/query logs of every connected data source for unfamiliar or bulk-export queries
- Add detection for the attack signature: POST /api/session/reset_password returning HTTP 400 immediately followed by GET /api/user/current returning HTTP 200 from the same source IP
- Treat Metabase (and other BI/analytics tools with stored connections to production data) as a trusted-relationship attack surface in third-party risk assessments
Weaknesses (CWE) in Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf)
CWE-89
Timeline of Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf)
- Metabase identifies the attack activity occurring against its own Metabase Cloud SaaS platform, which is how the previously unknown vulnerability first comes to light.
- Attackers exploit the unauthenticated SQL injection zero-day against Metabase Cloud instances belonging to Framework and Tally, obtaining administrator sessions via the reset_password endpoint.
- Metabase publishes GitHub Security Advisory GHSA-vwf4-m7j8-wcjf describing the unauthenticated SQL injection (CVSS 10.0) and releases patched versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 (plus matching 1.x Enterprise builds).
- Metabase notifies Framework that its instance had been vulnerable to the zero-day and was accessed by the attacker on 2026-08-03.
- Tally discloses that customer email addresses and one-way password hashes were accessed through a compromised Metabase analytics environment; LexisNexis discloses unusual activity affecting third-party-hosted systems including a Metabase API and disconnects the affected environment pending forensic investigation.
- Hosting provider Clever Cloud deploys automatic edge blocking of POST /api/session/reset_password for at-risk Metabase add-on customers still running an affected version.
- Framework notifies 'all customers' of the breach roughly six hours after learning of it, disclosing exposure of names, emails, phone numbers, addresses, and login IPs; states payment data and admin access outside Metabase were unaffected.
- Security Affairs, The Hacker News, and other outlets publish coverage of the active-exploitation zero-day and the Framework/Tally breach disclosures.
Sources cited for Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf)
- Security Affairs: Metabase zero-day exploited in the wild, exposing admin access and sensitive data
- GHSA-vwf4-m7j8-wcjf: SQL injection using an unauthenticated endpoint leading to admin access
- Metabase SQLi zero-day exploited in customer data-theft attacks (Framework, Tally disclose)
- Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
- Computer maker Framework notifies 'all customers' of a data breach
- Framework customer information was accessed as part of a data breach
- Metabase zero-day: Data leak at laptop manufacturer Framework
- Clever Cloud Changelog: Metabase critical security update, password reset endpoint blocked
Threats related to Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf)
- Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Unauthenticated Admin Access
- Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover
- Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf): Unauthenticated SQL Injection via /api/session/reset_password Exploited to Steal Database Credentials
- Unauthenticated SQL Injection Zero-Day in Metabase (CVSS 10.0, GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework, Tally, and LexisNexis Customer Data
- Critical Metabase Zero-Day (CVE-2026-72898): Unauthenticated SQL Injection Grants Admin Access, Exploited in the Wild
- Unauthenticated Metabase SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework and Tally Customer Data
Detection coverage for TL-2026-1946
As of 2026-08-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1946 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.