# Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover

> An unauthenticated SQL injection zero-day in Metabase's publicly reachable POST /api/session/reset_password endpoint (GHSA-vwf4-m7j8-wcjf, CVSS 10.0, no CVE assigned) lets attackers inject arbitrary SQL to seize administrator access without credentials, steal connected-database credentials, and exfiltrate data. Metabase's own Metabase Cloud SaaS platform was breached on 2026-08-03, and customers Framework and Tally have disclosed unauthorized access to customer data; LexisNexis was separately impacted through a third-party vendor that hosted Metabase.

- **Published:** 2026-08-09T00:00:00Z
- **Last reviewed:** 2026-08-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1958
- **ID:** TL-2026-1958
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Metabase disclosed a maximum-severity (CVSS 3.1: 10.0) unauthenticated SQL injection vulnerability, tracked as GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, in the publicly reachable POST /api/session/reset_password endpoint. No CVE identifier had been assigned as of publication (2026-08-09); a separate, unrelated Metabase Enterprise vulnerability, CVE-2026-33725 (serialization-import RCE, CVSS 7.2), was confirmed during research to NOT be this flaw.

An unauthenticated remote attacker can send crafted input to the reset_password endpoint to inject arbitrary SQL statements directly into the Metabase application database without ever logging in. Successful exploitation lets the attacker manipulate database records to promote themselves to an administrator account, "effectively gaining full control" of the instance. From there, the attacker can modify application configuration, extract credentials for every database connected to the Metabase instance, read any data reachable through those connections, and export it. DashboardFox's post-incident analysis frames the severity as a direct consequence of BI-platform architecture: Metabase centralizes live credentials for every connected data source, so a single application-layer compromise cascades into every downstream database the instance can reach — and situates this incident within a broader 2026 pattern of Metabase security issues sharing that same credential-centralization theme.

Metabase confirmed active, real-world exploitation. The company's own Metabase Cloud multi-tenant SaaS platform was itself breached on 2026-08-03; Metabase detected the abuse and deployed an emergency patch to Cloud within hours, upgrading all Cloud instances automatically. Metabase then shipped patched self-hosted releases on 2026-08-06 (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 for the open-source line, and the matching 1.58.24-1.63.5 releases for Enterprise Edition) and published GHSA-vwf4-m7j8-wcjf plus an official blog post. On 2026-08-06 Metabase notified customer Framework of the compromise; on 2026-08-07 Metabase, Framework, and Tally publicly disclosed the data-theft attacks. Framework (a laptop/PC manufacturer) confirmed attackers accessed customer names, email addresses, login IP addresses, billing/shipping addresses, phone numbers, company names, and for Framework for Business customers, VAT/EIN and billing-email data; payment data was not affected. Tally (an online form-builder platform) confirmed attackers accessed customer email addresses and password hashes, but not form content or submitted responses. LexisNexis separately warned customers it was impacted by a cyberattack at a third-party vendor that hosted Metabase on its behalf, and disconnected from the affected third-party systems as a precaution while investigating with a forensics firm; it remains unclear whether LexisNexis customer data was exposed.

Metabase published an official detection signature for compromise: a POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200 — indicating the attacker successfully forged an authenticated admin session via the injection. Metabase CEO Sameer Al-Sakran told reporters: "If you find that pattern in your application logs...it is likely that your instance has been compromised." Hosting provider Clever Cloud, which blocked the endpoint platform-wide for its hosted Metabase customers ahead of individual patching, published a refined version of the same signature requiring both requests to originate "from the same IP address" — tightening the correlation rule to reduce false positives from unrelated 400/200 log noise. Metabase's post-patch remediation guidance for self-hosted operators includes revoking all active sessions by clearing the core_session table, auditing and removing unrecognized API keys, reviewing administrator accounts for unauthorized changes, rotating all connected-database credentials, and reviewing Metabase activity history and connected-database access logs. Operators unable to patch immediately were advised to temporarily block public access to the reset_password endpoint; multiple hosting providers (e.g., Clever Cloud) applied this block automatically on behalf of their customers.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1588 Obtain Capabilities
- T1098 Account Manipulation
- T1552 Unsecured Credentials
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation

## Sources

- [SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Security update available for Metabase - Please upgrade now](https://www.metabase.com/blog/security-update)
- [Metabase SQLi zero-day exploited in customer data-theft attacks](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)
- [Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data](https://securityaffairs.com/196874/hacking/metabase-zero-day-exploited-in-the-wild-exposing-admin-access-and-sensitive-data.html)
- [Metabase 0-Day Vulnerability](https://cybersecuritynews.com/metabase-0-day-vulnerability/)
- [Metabase zero-day: Data leak at laptop manufacturer Framework](https://www.heise.de/en/news/Metabase-zero-day-Data-leak-at-laptop-manufacturer-Framework-11403251.html)
- [Metabase critical security update, password reset endpoint blocked](https://www.clever.cloud/developers/changelog/2026/08-07-metabase-security-reset-password)
- [Metabase Breach (August 2026): What the Critical 0-Day Means for Your BI Data](https://dashboardfox.com/blog/metabase-breach-bi-security/)
- [LeakWatch CW 32/2026: Metabase Zero-Day and Xbox Leak](https://www.igorslab.de/en/leakwatch-cw-32-2026-metabase-zero-day-hits-framework-trueconf-becomes-malware-gateway-microsofts-xbox-plans-leak/)
- [Metabase Urges Self-Hosted Users to Patch Critical SQL Flaw](https://sqmagazine.co.uk/metabase-security-update/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1958