# Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf): Unauthenticated SQL Injection via /api/session/reset_password Exploited to Steal Database Credentials

> An unauthenticated SQL injection zero-day (CVSS 10.0, no CVE assigned) in Metabase's POST /api/session/reset_password endpoint let attackers inject arbitrary SQL into the application database, self-promote to administrator, and steal credentials for every connected data source. Metabase Cloud was breached with it on 2026-08-03, and self-hosted victims Framework and Tally, plus a third-party vendor of LexisNexis, disclosed data theft before patches (0.58.24-0.63.5 line) shipped on 2026-08-07.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1969
- **ID:** TL-2026-1969
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Metabase, a widely deployed open-source and cloud business-intelligence/analytics platform, shipped a critical unauthenticated SQL injection flaw in every release from the 0.58/1.58 branch through 0.63.3/1.63.3. The bug lives in the publicly reachable POST /api/session/reset_password endpoint: because the endpoint required no prior authentication, an attacker could submit a crafted request whose parameters were concatenated into a SQL statement executed against the Metabase application database rather than being properly parameterized. Metabase's own advisory and multiple technical write-ups describe the resulting primitive as sufficient to modify database records so the attacker's forged session is recognized as belonging to an administrator, without ever supplying valid credentials.

Once an attacker holds administrator-level access to a Metabase instance, they can change application configuration, read the stored connection strings/credentials for every database Metabase is wired up to, and use Metabase's own query and export functionality to pull data out of those connected systems. Metabase confirmed active zero-day exploitation against its own Metabase Cloud SaaS platform starting 2026-08-03, before the vulnerability was understood, blocking the vulnerable endpoint and patching in response. Independently, self-hosted customers Framework (laptop manufacturer) and Tally (online form builder) disclosed that their own Metabase instances were compromised the same day, 2026-08-03, with attacker access confirmed via the same log signature Metabase later published as the compromise indicator: a POST to /api/session/reset_password returning HTTP 400 immediately followed by a GET to /api/user/current returning HTTP 200 from the same source. LexisNexis separately disclosed it was impacted through a third-party vendor that hosted its Diligence, Metabase API, and Newsdesk applications on Metabase, taking those applications offline pending forensic investigation; this is a distinct incident from LexisNexis's unrelated March 2026 AWS/React2Shell breach.

Metabase published GitHub Security Advisory GHSA-vwf4-m7j8-wcjf (CVSS 3.1 base score 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) alongside patched point releases across all six affected branches (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5, mirrored on the 1.x Enterprise/Pro version line) on 2026-08-07. No CVE identifier has been assigned as of disclosure. Hosting providers such as Clever Cloud responded by automatically blocking outbound requests to the vulnerable endpoint for customer instances still running affected versions. Metabase's guidance for any instance that was internet-reachable on a vulnerable version is to treat it as compromised: purge the core_session table to invalidate all active sessions, audit and remove unrecognized API keys, review administrator accounts for unauthorized changes, rotate credentials for every connected database, and review data-warehouse/query logs for anomalous activity.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1098 Account Manipulation
- T1606 Forge Web Credentials
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials
- T1033 System Owner/User Discovery
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1565.001 Stored Data Manipulation

## Sources

- [Metabase 0-Day Flaw Exploited in Attack to Inject Arbitrary SQL and Steal Database Credentials](https://gbhackers.com/metabase-0-day-flaw/)
- [Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Metabase SQLi zero-day exploited in customer data-theft attacks](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)
- [Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access](https://cybersecuritynews.com/metabase-0-day-vulnerability/)
- [Metabase critical security update, password reset endpoint blocked](https://www.clever.cloud/developers/changelog/2026/08-07-metabase-security-reset-password)
- [Metabase SQL Injection Zero-Day (CVSS 10) Exploited](https://securityonline.info/metabase-sql-injection-zero-day-exploited/)
- [Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data](https://securityaffairs.com/196874/hacking/metabase-zero-day-exploited-in-the-wild-exposing-admin-access-and-sensitive-data.html)
- [Security update available for Metabase - Please upgrade now](https://www.metabase.com/blog/security-update)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1969