Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf): Unauthenticated SQL Injection via /api/session/reset_password Exploited to Steal Database Credentials
Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) (TL-2026-1969), also tracked as Metabase Password-Reset SQL Injection Zero-Day, is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-10. It has no confirmed attribution, affects Metabase, Inc. Metabase (self-hosted Open Source and Enterprise/Pro, maps to 9 MITRE ATT&CK techniques (T1033, T1098, T1190), and is covered by 9 detection rules and 9 indicators of compromise.
Key facts for TL-2026-1969
- Threat ID
- TL-2026-1969
- Also known as
- Metabase Password-Reset SQL Injection Zero-Day, GHSA-vwf4-m7j8-wcjf
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, manufacturing, legal, professionalservices, saas
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 9
An unauthenticated SQL injection zero-day (CVSS 10.0, no CVE assigned) in Metabase's POST /api/session/reset_password endpoint let attackers inject arbitrary SQL into the application database, self-promote to administrator, and steal credentials for every connected data source. Metabase Cloud was breached with it on 2026-08-03, and self-hosted victims Framework and Tally, plus a third-party vendor of LexisNexis, disclosed data theft before patches (0.58.24-0.63.5 line) shipped on 2026-08-07.
How Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) works
Metabase, a widely deployed open-source and cloud business-intelligence/analytics platform, shipped a critical unauthenticated SQL injection flaw in every release from the 0.58/1.58 branch through 0.63.3/1.63.3. The bug lives in the publicly reachable POST /api/session/reset_password endpoint: because the endpoint required no prior authentication, an attacker could submit a crafted request whose parameters were concatenated into a SQL statement executed against the Metabase application database rather than being properly parameterized. Metabase's own advisory and multiple technical write-ups describe the resulting primitive as sufficient to modify database records so the attacker's forged session is recognized as belonging to an administrator, without ever supplying valid credentials.
Once an attacker holds administrator-level access to a Metabase instance, they can change application configuration, read the stored connection strings/credentials for every database Metabase is wired up to, and use Metabase's own query and export functionality to pull data out of those connected systems. Metabase confirmed active zero-day exploitation against its own Metabase Cloud SaaS platform starting 2026-08-03, before the vulnerability was understood, blocking the vulnerable endpoint and patching in response. Independently, self-hosted customers Framework (laptop manufacturer) and Tally (online form builder) disclosed that their own Metabase instances were compromised the same day, 2026-08-03, with attacker access confirmed via the same log signature Metabase later published as the compromise indicator: a POST to /api/session/reset_password returning HTTP 400 immediately followed by a GET to /api/user/current returning HTTP 200 from the same source. LexisNexis separately disclosed it was impacted through a third-party vendor that hosted its Diligence, Metabase API, and Newsdesk applications on Metabase, taking those applications offline pending forensic investigation; this is a distinct incident from LexisNexis's unrelated March 2026 AWS/React2Shell breach.
Metabase published GitHub Security Advisory GHSA-vwf4-m7j8-wcjf (CVSS 3.1 base score 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) alongside patched point releases across all six affected branches (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5, mirrored on the 1.x Enterprise/Pro version line) on 2026-08-07. No CVE identifier has been assigned as of disclosure. Hosting providers such as Clever Cloud responded by automatically blocking outbound requests to the vulnerable endpoint for customer instances still running affected versions. Metabase's guidance for any instance that was internet-reachable on a vulnerable version is to treat it as compromised: purge the core_session table to invalidate all active sessions, audit and remove unrecognized API keys, review administrator accounts for unauthorized changes, rotate credentials for every connected database, and review data-warehouse/query logs for anomalous activity.
MITRE ATT&CK techniques used in TL-2026-1969
Discovery
T1033 System Owner/User Discovery
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1606 Forge Web Credentials
Collection
T1213 Data from Information Repositories
Impact
T1565.001 Stored Data Manipulation
Exfiltration
Affected products and versions in Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf)
- Metabase, Inc. — Metabase (self-hosted Open Source and Enterprise/Pro, and Metabase Cloud)
Vulnerable versions: 0.58.0-0.58.23; 0.59.0-0.59.20; 0.60.0-0.60.16; 0.61.0-0.61.10; 0.62.0-0.62.8; 0.63.0-0.63.3; 1.58.0-1.58.23; 1.59.0-1.59.20; 1.60.0-1.60.16; 1.61.0-1.61.10
Fixed in: 0.58.24; 0.59.21; 0.60.17; 0.61.11; 0.62.9; 0.63.5; 1.58.24; 1.59.21; 1.60.17; 1.61.11
Remediation for Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf)
Patches
- Metabase 0.58.24 / 1.58.24
- Metabase 0.59.21 / 1.59.21
- Metabase 0.60.17 / 1.60.17
- Metabase 0.61.11 / 1.61.11
- Metabase 0.62.9 / 1.62.9
- Metabase 0.63.5 / 1.63.5
Immediate actions
- Upgrade self-hosted Metabase to the patched point release for your branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (mirrored on the 1.x line)
- If unable to patch immediately, block/deny all requests to POST /api/session/reset_password at a reverse proxy or WAF
- Search application logs for the compromise signature: POST /api/session/reset_password returning HTTP 400 immediately followed by GET /api/user/current returning HTTP 200 from the same source IP
Workarounds
- Temporarily block network access to POST /api/session/reset_password until the instance is upgraded
Longer-term hardening
- Treat any internet-reachable Metabase instance that was running a vulnerable version as compromised and execute full incident response, not just patching
- Restrict administrative and API surfaces of BI/analytics tools to internal networks or behind SSO/VPN rather than exposing them directly to the internet
- Inventory every downstream database credential stored in BI tools and rotate on any suspected compromise of the BI layer
Weaknesses (CWE) in Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf)
CWE-89, CWE-306
Timeline of Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf)
- Tally's Metabase instance is compromised; attacker accesses user email addresses and one-way-hashed passwords (form contents/answers not affected)
- Metabase Cloud platform breached via the then-unknown zero-day in POST /api/session/reset_password; Framework's self-hosted Metabase instance is accessed by the attacker the same day
- Clever Cloud automatically blocks requests to the vulnerable POST /api/session/reset_password endpoint for hosted Metabase instances on affected versions
- Metabase identifies the vulnerability and begins notifying affected customers, including Framework
- BleepingComputer reports the Framework and Tally data-theft incidents tied to the Metabase zero-day
- Metabase releases patched point versions across all six affected branches (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5, mirrored on 1.x) and publishes advisory GHSA-vwf4-m7j8-wcjf
- The Hacker News, SecurityAffairs, and SecurityOnline publish wide public-disclosure coverage of the zero-day, its CVSS 10.0 rating, and confirmed active exploitation
- LexisNexis discloses it was impacted via a third-party vendor hosting Metabase, taking its Diligence, Metabase API, and Newsdesk applications offline pending forensic investigation
Sources cited for Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf)
- Metabase 0-Day Flaw Exploited in Attack to Inject Arbitrary SQL and Steal Database Credentials
- Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
- SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)
- Metabase SQLi zero-day exploited in customer data-theft attacks
- Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access
- Metabase critical security update, password reset endpoint blocked
- Metabase SQL Injection Zero-Day (CVSS 10) Exploited
- Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data
- Security update available for Metabase - Please upgrade now
Threats related to Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf)
- Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover
- Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) Exploited In the Wild for Admin Access
- Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Unauthenticated Admin Access
- Critical Metabase Zero-Day (CVE-2026-72898): Unauthenticated SQL Injection Grants Admin Access, Exploited in the Wild
- Unauthenticated SQL Injection Zero-Day in Metabase (CVSS 10.0, GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework, Tally, and LexisNexis Customer Data
- Metabase Unauthenticated SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) Exploited to Steal Connected Database Credentials
Detection coverage for TL-2026-1969
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1969 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.