Threat reportVulnerabilityTL-2026-1958
Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover
Metabase Unauthenticated SQL Injection 0-Day (TL-2026-1958) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-09. It has no confirmed attribution, affects Metabase Metabase Open Source, maps to 9 MITRE ATT&CK techniques (T1078, T1098, T1190), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-1958
- Threat ID
- TL-2026-1958
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, electronics-manufacturing, legal-services, information-services, software-as-a-service, business-intelligence
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 12
How Metabase Unauthenticated SQL Injection 0-Day works
An unauthenticated SQL injection zero-day in Metabase's publicly reachable POST /api/session/reset_password endpoint (GHSA-vwf4-m7j8-wcjf, CVSS 10.0, no CVE assigned) lets attackers inject arbitrary SQL to seize administrator access without credentials, steal connected-database credentials, and exfiltrate data. Metabase's own Metabase Cloud SaaS platform was breached on 2026-08-03, and customers Framework and Tally have disclosed unauthorized access to customer data; LexisNexis was separately impacted through a third-party vendor that hosted Metabase.
Metabase disclosed a maximum-severity (CVSS 3.1: 10.0) unauthenticated SQL injection vulnerability, tracked as GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, in the publicly reachable POST /api/session/reset_password endpoint. No CVE identifier had been assigned as of publication (2026-08-09); a separate, unrelated Metabase Enterprise vulnerability, CVE-2026-33725 (serialization-import RCE, CVSS 7.2), was confirmed during research to NOT be this flaw.
An unauthenticated remote attacker can send crafted input to the reset_password endpoint to inject arbitrary SQL statements directly into the Metabase application database without ever logging in. Successful exploitation lets the attacker manipulate database records to promote themselves to an administrator account, "effectively gaining full control" of the instance. From there, the attacker can modify application configuration, extract credentials for every database connected to the Metabase instance, read any data reachable through those connections, and export it. DashboardFox's post-incident analysis frames the severity as a direct consequence of BI-platform architecture: Metabase centralizes live credentials for every connected data source, so a single application-layer compromise cascades into every downstream database the instance can reach — and situates this incident within a broader 2026 pattern of Metabase security issues sharing that same credential-centralization theme.
Metabase confirmed active, real-world exploitation. The company's own Metabase Cloud multi-tenant SaaS platform was itself breached on 2026-08-03; Metabase detected the abuse and deployed an emergency patch to Cloud within hours, upgrading all Cloud instances automatically. Metabase then shipped patched self-hosted releases on 2026-08-06 (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 for the open-source line, and the matching 1.58.24-1.63.5 releases for Enterprise Edition) and published GHSA-vwf4-m7j8-wcjf plus an official blog post. On 2026-08-06 Metabase notified customer Framework of the compromise; on 2026-08-07 Metabase, Framework, and Tally publicly disclosed the data-theft attacks. Framework (a laptop/PC manufacturer) confirmed attackers accessed customer names, email addresses, login IP addresses, billing/shipping addresses, phone numbers, company names, and for Framework for Business customers, VAT/EIN and billing-email data; payment data was not affected. Tally (an online form-builder platform) confirmed attackers accessed customer email addresses and password hashes, but not form content or submitted responses. LexisNexis separately warned customers it was impacted by a cyberattack at a third-party vendor that hosted Metabase on its behalf, and disconnected from the affected third-party systems as a precaution while investigating with a forensics firm; it remains unclear whether LexisNexis customer data was exposed.
Metabase published an official detection signature for compromise: a POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200 — indicating the attacker successfully forged an authenticated admin session via the injection. Metabase CEO Sameer Al-Sakran told reporters: "If you find that pattern in your application logs...it is likely that your instance has been compromised." Hosting provider Clever Cloud, which blocked the endpoint platform-wide for its hosted Metabase customers ahead of individual patching, published a refined version of the same signature requiring both requests to originate "from the same IP address" — tightening the correlation rule to reduce false positives from unrelated 400/200 log noise. Metabase's post-patch remediation guidance for self-hosted operators includes revoking all active sessions by clearing the core_session table, auditing and removing unrecognized API keys, reviewing administrator accounts for unauthorized changes, rotating all connected-database credentials, and reviewing Metabase activity history and connected-database access logs. Operators unable to patch immediately were advised to temporarily block public access to the reset_password endpoint; multiple hosting providers (e.g., Clever Cloud) applied this block automatically on behalf of their customers.
MITRE ATT&CK techniques used in TL-2026-1958
stealth
Persistence
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Collection
T1213 Data from Information Repositories
Credential Access
Impact
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in Metabase Unauthenticated SQL Injection 0-Day
- Metabase — Metabase Open Source
Vulnerable versions: 0.58.0-0.58.23; 0.59.0-0.59.20; 0.60.0-0.60.16; 0.61.0-0.61.10; 0.62.0-0.62.8; 0.63.0-0.63.3
Fixed in: 0.58.24; 0.59.21; 0.60.17; 0.61.11; 0.62.9; 0.63.5 - Metabase — Metabase Enterprise Edition
Vulnerable versions: 1.58.0-1.58.23; 1.59.0-1.59.20; 1.60.0-1.60.16; 1.61.0-1.61.10; 1.62.0-1.62.8; 1.63.0-1.63.3
Fixed in: 1.58.24; 1.59.21; 1.60.17; 1.61.11; 1.62.9; 1.63.5
Remediation for Metabase Unauthenticated SQL Injection 0-Day
Patches
- 0.58.24
- 0.59.21
- 0.60.17
- 0.61.11
- 0.62.9
- 0.63.5
- Enterprise Edition 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, 1.63.5
Immediate actions
- Block or deny public access to POST /api/session/reset_password at the WAF or reverse proxy until the instance is patched
- Upgrade to the patched release for your branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (open source), or the matching 1.58.24-1.63.5 Enterprise Edition releases
- Revoke all active sessions by clearing the core_session table
- Audit and remove unrecognized API keys
- Review administrator accounts for unauthorized additions or password changes
- Rotate credentials for every database connected to the Metabase instance
- Review Metabase activity history and connected-database access/query logs for the published 400-then-200 reset_password/user-current compromise pattern, correlated to a single source IP per Clever Cloud's refined detection rule
Workarounds
- Temporarily block/deny requests to /api/session/reset_password at the reverse proxy or WAF if immediate upgrade is not possible
Longer-term hardening
- Never expose Metabase's session/authentication API endpoints directly to the public internet; front self-hosted instances with a VPN, SSO proxy, or IP allowlist
- Subscribe to metabase/metabase GitHub Security Advisories to catch future disclosures quickly
- For SaaS- or third-party-hosted BI deployments, require vendor breach-notification and incident-response terms in contracts, given the LexisNexis third-party exposure
- Treat BI/analytics platforms as high-value credential stores in architecture and access reviews, since a single compromise exposes every connected database's credentials
Weaknesses (CWE) in Metabase Unauthenticated SQL Injection 0-Day
Timeline of Metabase Unauthenticated SQL Injection 0-Day
- Metabase detects abuse on its own Metabase Cloud platform, blocks the abused endpoints, and deploys an emergency patch to Cloud within hours; all Cloud instances are upgraded automatically.
- Attackers begin exploiting the then-unknown reset_password SQLi against Metabase Cloud and customer-facing instances; Framework and Tally are among the environments accessed.
- Metabase notifies customer Framework that its instance was compromised via the vulnerability.
- Metabase ships patched self-hosted releases (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 and matching Enterprise Edition 1.x builds), publishes GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, and posts an official 'Security update available for Metabase' blog notice urging self-hosted customers to upgrade immediately.
- PaaS hosting provider Clever Cloud blocks all requests to /api/session/reset_password for its hosted Metabase customer instances as an emergency platform-level mitigation ahead of individual patching, and publishes a refined same-source-IP version of Metabase's detection signature.
- LexisNexis warns customers it was impacted by a cyberattack at a third-party vendor that hosted its Metabase instance and disconnects from the affected third-party systems pending a forensic investigation.
- Metabase, Framework, and Tally publicly disclose the data-theft attacks; Framework confirms customer PII (names, addresses, phone numbers, emails, login IPs) was accessed and Tally confirms customer emails and password hashes were accessed.
- BleepingComputer, The Hacker News, Security Affairs, heise online, and sqmagazine publish detailed coverage of the active-exploitation campaign, the Metabase Cloud breach, and the Framework/Tally/LexisNexis disclosures, including Metabase CEO Sameer Al-Sakran's public log-pattern compromise guidance.
- Cyber Security News and industry roundups (LeakWatch) publish coverage aggregating the zero-day disclosure and breach timeline, triggering this threat record.
Sources cited for Metabase Unauthenticated SQL Injection 0-Day
- SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)
- Security update available for Metabase - Please upgrade now
- Metabase SQLi zero-day exploited in customer data-theft attacks
- Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
- Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data
- Metabase 0-Day Vulnerability
- Metabase zero-day: Data leak at laptop manufacturer Framework
- Metabase critical security update, password reset endpoint blocked
- Metabase Breach (August 2026): What the Critical 0-Day Means for Your BI Data
- LeakWatch CW 32/2026: Metabase Zero-Day and Xbox Leak
- Metabase Urges Self-Hosted Users to Patch Critical SQL Flaw
Detection coverage for TL-2026-1958
As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1958 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.