# Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) Exploited In the Wild for Admin Access

> An unauthenticated, CVSS 10.0 SQL injection zero-day in the Metabase business-intelligence platform (GHSA-vwf4-m7j8-wcjf), reachable through the unauthenticated POST /api/session/reset_password endpoint, let attackers escalate straight to administrator access, steal credentials for every database connected to the instance, and exfiltrate data. Metabase discovered the flaw only after its own Metabase Cloud SaaS was compromised on 2026-08-03; downstream customers Framework and Tally have confirmed data theft, and LexisNexis disclosed a related Metabase-linked service disruption.

- **Published:** 2026-08-08T00:00:00Z
- **Last reviewed:** 2026-08-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1946
- **ID:** TL-2026-1946
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-08-06 Metabase, Inc. published GitHub Security Advisory GHSA-vwf4-m7j8-wcjf disclosing a maximum-severity (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) unauthenticated SQL injection vulnerability in the Metabase application. The flaw is reachable through the unauthenticated POST /api/session/reset_password endpoint, which the vendor's own attack signature describes as returning an HTTP 400 status code when abused, immediately followed by a successful GET /api/user/current call returning HTTP 200 -- indicating the attacker obtained a valid, authenticated (administrator-capable) session without ever supplying credentials. No CVE identifier has been assigned as of publication; the flaw is tracked solely via the GitHub Security Advisory.

Metabase became aware of the vulnerability not through internal testing but because it was already being exploited against Metabase's own multi-tenant Metabase Cloud SaaS platform, making this a genuine zero-day: real-world attackers found and weaponized the bug before the vendor did. With the session obtained through the injection, an attacker gains full administrator capability inside the Metabase instance: modifying application configuration, reading the credentials Metabase stores for every connected data source (databases, warehouses, and other backends), running arbitrary queries against those connections, and exporting the results. Because Metabase is a BI/analytics layer that sits in front of a customer's actual production and warehouse data, compromising the Metabase layer functions as a trusted-relationship pivot into whatever data those connections expose -- without the attacker ever touching the customer's own infrastructure directly.

The vulnerability affects self-hosted open-source Metabase 0.58.0 through 0.63.3 and the corresponding Enterprise Edition releases 1.58.0 through 1.63.3 (versions 0.57/1.57 and earlier are unaffected); it is fixed in 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 (and the matching 1.x Enterprise builds). Metabase Cloud instances were patched by the vendor before the public advisory; self-hosted instances required (and in many cases still require) a manual upgrade, and several hosting providers, including Clever Cloud, deployed automatic edge blocking of the reset_password endpoint for at-risk customers as an interim mitigation.

Metabase notified affected Cloud customer Framework (a PC/laptop manufacturer) on 2026-08-06 that its instance had been vulnerable and was accessed by the attacker on 2026-08-03. Framework notified 'all customers' within roughly six hours of learning of the breach; exposed data included customer names, email addresses, login IP addresses, billing/shipping addresses, and phone numbers (and, for Framework for Business accounts, company name, VAT/EIN, and billing email address). Payment and order data were reportedly untouched, and Framework stated it found no evidence of changes to admin access or to systems outside of Metabase. Tally, a form-builder SaaS, separately disclosed that an attacker accessed customer email addresses and one-way password hashes through a compromised Metabase analytics environment (form and submission data were reported unaffected). LexisNexis also disclosed unusual activity affecting third-party-hosted systems including a Metabase API, and disconnected the affected environment pending a forensic investigation; the scope of any data exposure there remains unconfirmed. Metabase has engaged a third-party forensic firm and describes its findings as preliminary. This is not Metabase's first critical pre-authentication flaw: the vendor previously patched CVE-2023-38646 (CVSS 9.8), a pre-auth remote code execution vulnerability, in 2023.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1098 Account Manipulation
- T1078.004 Cloud Accounts
- T1550.004 Web Session Cookie
- T1552 Unsecured Credentials
- T1087 Account Discovery
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service

## Sources

- [Security Affairs: Metabase zero-day exploited in the wild, exposing admin access and sensitive data](https://securityaffairs.com/196874/hacking/metabase-zero-day-exploited-in-the-wild-exposing-admin-access-and-sensitive-data.html)
- [GHSA-vwf4-m7j8-wcjf: SQL injection using an unauthenticated endpoint leading to admin access](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Metabase SQLi zero-day exploited in customer data-theft attacks (Framework, Tally disclose)](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)
- [Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [Computer maker Framework notifies 'all customers' of a data breach](https://techcrunch.com/2026/08/07/computer-maker-framework-notifies-all-customers-of-a-data-breach/)
- [Framework customer information was accessed as part of a data breach](https://www.engadget.com/2232708/framework-customer-information-was-accessed-as-part-of-a-data-breach/)
- [Metabase zero-day: Data leak at laptop manufacturer Framework](https://www.heise.de/en/news/Metabase-zero-day-Data-leak-at-laptop-manufacturer-Framework-11403251.html)
- [Clever Cloud Changelog: Metabase critical security update, password reset endpoint blocked](https://www.clever.cloud/developers/changelog/2026/08-07-metabase-security-reset-password)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1946