Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover — Threadlinqs Intelligence
As of 2026-08-09, Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-1958 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
An unauthenticated SQL injection zero-day in Metabase's publicly reachable POST /api/session/reset_password endpoint (GHSA-vwf4-m7j8-wcjf, CVSS 10.0, no CVE assigned) lets attackers inject arbitrary
Metabase disclosed a maximum-severity (CVSS 3.1: 10.0) unauthenticated SQL injection vulnerability, tracked as GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, in the publicly reachable POST /api/session/reset_password endpoint. No CVE identifier had been assigned as of publication (2026-08-09); a separate, unrelated Metabase Enterprise vulnerability, CVE-2026-33725 (serialization-import RCE, CVSS 7.2), was confirmed during research to NOT be this flaw.
An unauthenticated remote attacker can send crafted input to the reset_password endpoint to inject arbitrary SQL statements directly into the Metabase application database without ever logging in. Successful exploitation lets the attacker manipulate database records to promote themselves to an administrator account, "effectively gaining full control" of the instance. From there, the attacker can modify application configuration, extract credentials for every database connected to the Metabase instance, read any data reachable through those connections, and export it. DashboardFox's post-incident analysis frames the severity as a direct consequence of BI-platform architecture: Metabase centralizes live credentials for every connected data source, so a single application-layer compromise cascades into every downstream database the instance can reach — and situates this incident within a broader 2026 pattern of Metabase security issues sharing that same credential-centralization theme.
Metabase confirmed active, real-world exploitation. The company's own Metabase Cloud multi-tenant SaaS platform was itself breached on 2026-08-03; Metabase detected the abuse and deployed an emergency patch to Cloud within hours, upgrading all Cloud instances automatically. Metabase then shipped patched self-hosted releases on 2026-08-06 (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 for the open-source line, and the matching 1.58.24-1.63.5 releases for Enterprise Edition) and published GHSA-vwf4-m7j8-wcjf plus an official blog post. On 2026-08-06 Metabase notified customer Framework of the compromise; on 2026-08-07 Metabase, Framework, and Tally publicly disclosed the data-theft attacks. Framework (a laptop/PC manufacturer) confirmed attackers accessed customer names, email addresses, login IP addresses, billing/shipping addresses, phone numbers, company names, and for Framework for Business customers, VAT/EIN and billing-email data; payment data was not affected. Tally (an online form-builder platform) confirmed attackers accessed customer email addresses and password hashes, but not form content or submitted responses. LexisNexis separately warned customers it was impacted by a cyberattack at a third-party vendor that hosted Metabase on its behalf, and disconnected from the affected third-party systems as a precaution while investigating with a forensics firm; it remains unclear whether LexisNexis customer data was exposed.
Metabase published an official detection signature for compromise: a POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200 — indicating the attacker successfully forged an authenticated admin session via the injection. Metabase CEO Sameer Al-Sakran told reporters: "If you find that pattern in your application logs...it is likely that your instance has been compromised." Hosting provider Clever Cloud, which blocked the endpoint platform-wide for its hosted Metabase customers ahead of individual patching, published a refined version of the same signature requiring both requests to originate "from the same IP address" — tightening the correlation rule to reduce false positives from unrelated 400/200 log noise. Metabase's post-patch remediation guidance for self-hosted operators includes revoking all active sessions by clearing the core_session table, auditing and removing unrecognized API keys, reviewing administrator accounts for unauthorized changes, rotating all connected-database credentials, and rev
Target sectors: technology, electronics-manufacturing, legal-services, information-services, software-as-a-service, business-intelligence
Target regions: North America, Global
Detections & IOCs
As of 2026-08-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1190, T1199, T1588, T1098, T1552, T1078, T1213, T1567, T1565
