Unauthenticated SQL Injection Zero-Day in Metabase (CVSS 10.0, GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework, Tally, and LexisNexis Customer Data
Unauthenticated SQL Injection Zero-Day in Metabase (CVSS (TL-2026-1974), also tracked as GHSA-vwf4-m7j8-wcjf, is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-10. It has no confirmed attribution, affects Metabase Metabase (Cloud and self-hosted), maps to 8 MITRE ATT&CK techniques (T1078, T1098, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
Key facts for TL-2026-1974
- Threat ID
- TL-2026-1974
- Also known as
- GHSA-vwf4-m7j8-wcjf
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software business intelligence, consumer electronics, legal and data analytics services, online forms and surveys
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
An unauthenticated SQL injection zero-day in Metabase's POST /api/session/reset_password endpoint (versions 0.58.0-0.63.3, branded 1.58 and above, both Cloud and self-hosted) let attackers inject arbitrary SQL, escalate to instance administrator without credentials, and steal stored connected-database credentials. Metabase confirmed active exploitation starting on or around 2026-08-03; Framework (laptop manufacturer) confirmed exposure of customer names, emails, phone numbers, addresses, and login IPs, Tally (form builder) confirmed exposure of emails and password hashes, and LexisNexis confirmed its Metabase API was impacted with exposure scope still under investigation.
How Unauthenticated SQL Injection Zero-Day in Metabase (CVSS works
Metabase, a widely deployed open-source and SaaS business-intelligence (BI) platform, disclosed a maximum-severity (CVSS 10.0) unauthenticated SQL injection vulnerability tracked as GHSA-vwf4-m7j8-wcjf. The flaw lives in the publicly reachable POST /api/session/reset_password endpoint: an attacker with no credentials can inject arbitrary SQL into the Metabase application database. By manipulating database records through this injection, the attacker can promote their own session or account to instance administrator, entirely bypassing authentication. Vulnerable releases span every branch from 0.58.0 through 0.63.3 (publicly versioned 1.58 and above), across both Metabase Cloud and self-hosted deployments; versions below 58 are unaffected. GHSA-vwf4-m7j8-wcjf gives slightly narrower per-branch affected ranges (0.58.0-0.58.22, 0.59.0-0.59.19, 0.60.0-0.60.15, 0.61.0-0.61.9, 0.62.0-0.62.7, 0.63.0-0.63.2) which this research treats as the authoritative boundary alongside the vendor's own 0.58.0-0.63.3 framing.
Once an attacker holds instance-admin privileges, Metabase's own design makes the blast radius severe: the application stores the connection credentials for every database a customer has wired into it for reporting and analytics. With admin access, the attacker can change application configuration, read those stored credentials, and use them to query connected production databases directly through Metabase's own established connections -- the resulting queries arrive at the downstream database from the legitimate, expected application account, indistinguishable from normal Metabase traffic. There is no malware payload or foreign network indicator to catch, only a distinctive HTTP log signature: a POST to /api/session/reset_password returning HTTP 400 immediately followed by a GET to /api/user/current returning HTTP 200 from the same source/session -- Metabase states plainly that finding this pattern in application or ingress logs means the instance was likely compromised.
Metabase confirmed active exploitation against its own Cloud infrastructure beginning on or before 2026-08-03. On 2026-08-06 Metabase notified Framework, a modular-laptop manufacturer, that its Cloud instance had been vulnerable and accessed; Framework in turn confirmed exposure of customer names, email addresses, phone numbers, physical addresses, login IP addresses, and (for Framework for Business accounts) company names, VAT/EIN numbers, and billing emails -- order and payment data were not affected, and Framework stated the breach affected all customers while it rotated database credentials and engaged third-party forensics. Tally, an online form-builder, confirmed its Metabase analytics environment was compromised the same day the attack began (2026-08-03), with the attacker reaching customer email addresses and password hashes ('password as a cryptographic hash'), though form content and submitted responses were not reached because they are stored separately from the analytics environment. LexisNexis confirmed 'unusual activity on servers that are hosted and managed by a third-party vendor' affecting its Metabase API integration and disconnected the affected systems to contain the issue; the specific scope of any customer-data exposure remains under investigation as of publication and is unrelated to LexisNexis's separate, earlier 2026 AWS/React2Shell breach. No further named victims beyond Framework, Tally, and LexisNexis appear across vendor, wire-service, or independent security-research coverage as of 2026-08-10, and none of the sources reviewed describe evidence of internet-wide scanning for exposed instances -- exploitation is documented only against Metabase's own Cloud-hosted fleet.
No CVE identifier has been assigned to this vulnerability; it is tracked solely via the GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, published 2026-08-06 by GitHub user perivamsi, with no CWE classification listed on the advisory itself (CWE-89 SQL Injection is assigned here as the evidenced root-cause weakness). Because vulnerability scanners that rely purely on NVD/CVE feeds will not flag exposed instances, Metabase's advisory and blog post are the authoritative sources for detection. Metabase patched the flaw and shipped fixed releases (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5), blocked the abused endpoint across its own Cloud fleet, and is urging all self-hosted administrators to upgrade immediately, purge sessions from the core_session table, revoke unrecognized API keys, review administrator-account changes, rotate every credential connected to their instance, and audit data-warehouse/query-history logs and Metabase activity history for unauthorized actions. This is a distinct vulnerability from the unrelated, separately tracked CVE-2026-50148 (Metabase RCE via Snowflake JDBC driver arbitrary file write); the two should not be conflated. No threat-actor attribution has been published for the intrusion.
MITRE ATT&CK techniques used in TL-2026-1974
Defense Evasion
Privilege Escalation
Persistence
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Collection
T1213 Data from Information Repositories
Discovery
Credential Access
Exfiltration
Affected products and versions in Unauthenticated SQL Injection Zero-Day in Metabase (CVSS
- Metabase — Metabase (Cloud and self-hosted)
Vulnerable versions: 0.58.0-0.58.23; 0.59.0-0.59.20; 0.60.0-0.60.16; 0.61.0-0.61.10; 0.62.0-0.62.8; 0.63.0-0.63.3; 1.58 and later (publicly branded versioning)
Fixed in: 0.58.24; 0.59.21; 0.60.17; 0.61.11; 0.62.9; 0.63.5
Remediation for Unauthenticated SQL Injection Zero-Day in Metabase (CVSS
Patches
- Metabase 0.58.24
- Metabase 0.59.21
- Metabase 0.60.17
- Metabase 0.61.11
- Metabase 0.62.9
- Metabase 0.63.5
Immediate actions
- Upgrade self-hosted Metabase to a patched release: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5
- Block or restrict public access to POST /api/session/reset_password until patched
- Delete all existing sessions from the core_session table to invalidate any attacker-created sessions
- Rotate credentials for every database connected to the Metabase instance
Workarounds
- Block or WAF-filter public requests to /api/session/reset_password at the perimeter
- Audit and revoke unrecognized API keys and review administrator-account changes for signs of persistence
- Review data-warehouse/query-history logs and Metabase activity history for unauthorized queries or configuration changes
Longer-term hardening
- Scope Metabase's database connections to read-only, view-limited service accounts rather than broad production credentials
- Segment analytics/BI access from tables holding direct customer PII
- Maintain a credential inventory with named owners and rotation schedules for every BI-tool database connection
Weaknesses (CWE) in Unauthenticated SQL Injection Zero-Day in Metabase (CVSS
CWE-89
Timeline of Unauthenticated SQL Injection Zero-Day in Metabase (CVSS
- Metabase detects active exploitation against its Cloud platform during the attack.
- Attacker begins exploiting the unauthenticated SQL injection in POST /api/session/reset_password against Metabase Cloud, gaining instance-admin access without credentials; Tally's Metabase analytics environment is compromised the same day.
- Metabase publishes its 'Security Update' blog post, ships patched versions (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5), and blocks the abused endpoint across its own Cloud fleet; all Cloud customers are automatically upgraded.
- GitHub Security Advisory GHSA-vwf4-m7j8-wcjf is published by perivamsi, detailing the flaw, the CVSS 10.0 score, affected versions 0.58.0-0.63.3, and patched releases.
- Metabase notifies Framework at 9:00 AM PT that its Cloud instance had been vulnerable and was accessed by the attacker.
- Clever Cloud, a PaaS hosting provider for managed Metabase deployments, blocks the /api/session/reset_password endpoint for its customers per its security changelog.
- Tally notifies its customers that its Metabase analytics environment was compromised, exposing email addresses and password hashes; forms and submitted responses were not reached because they are stored separately.
- BleepingComputer publishes 'Framework, Tally disclose Metabase data theft attacks,' confirming both companies' breach notifications and that no CVE identifier has been assigned.
- Independent security researchers (hard2bit, Security Affairs) publish technical analyses characterizing the flaw as a third-party/supply-chain BI risk and detailing the credential-theft-then-query exploitation chain.
- Framework emails affected customers disclosing exposure of names, emails, phone numbers, addresses, and login IPs (order and payment data unaffected), states the breach affected all customers, and confirms it rotated database credentials and engaged third-party forensics; The Register publishes coverage of the disclosure.
Sources cited for Unauthenticated SQL Injection Zero-Day in Metabase (CVSS
- SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)
- Security update available for Metabase - Please upgrade now
- Framework loses customer data in Metabase zero-day attack
- Framework, Tally disclose Metabase data theft attacks
- Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access
- Metabase zero-day: data leak through your BI tool
- Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
- Metabase critical security update, password reset endpoint blocked
- Tally discloses data breach affecting customer email addresses and password hashes
- Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data
- Metabase Zero-Day Attack Lets Hackers Gain Admin Access and Steal Database Credentials
Threats related to Unauthenticated SQL Injection Zero-Day in Metabase (CVSS
- Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover
- Metabase Unauthenticated SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) Exploited to Steal Connected Database Credentials
- Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) Exploited In the Wild for Admin Access
- Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf): Unauthenticated SQL Injection via /api/session/reset_password Exploited to Steal Database Credentials
- Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Unauthenticated Admin Access
- Critical Metabase Zero-Day (CVE-2026-72898): Unauthenticated SQL Injection Grants Admin Access, Exploited in the Wild
Detection coverage for TL-2026-1974
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1974 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.