# Unauthenticated SQL Injection Zero-Day in Metabase (CVSS 10.0, GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework, Tally, and LexisNexis Customer Data

> An unauthenticated SQL injection zero-day in Metabase's POST /api/session/reset_password endpoint (versions 0.58.0-0.63.3, branded 1.58 and above, both Cloud and self-hosted) let attackers inject arbitrary SQL, escalate to instance administrator without credentials, and steal stored connected-database credentials. Metabase confirmed active exploitation starting on or around 2026-08-03; Framework (laptop manufacturer) confirmed exposure of customer names, emails, phone numbers, addresses, and login IPs, Tally (form builder) confirmed exposure of emails and password hashes, and LexisNexis confirmed its Metabase API was impacted with exposure scope still under investigation.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1974
- **ID:** TL-2026-1974
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Metabase, a widely deployed open-source and SaaS business-intelligence (BI) platform, disclosed a maximum-severity (CVSS 10.0) unauthenticated SQL injection vulnerability tracked as GHSA-vwf4-m7j8-wcjf. The flaw lives in the publicly reachable POST /api/session/reset_password endpoint: an attacker with no credentials can inject arbitrary SQL into the Metabase application database. By manipulating database records through this injection, the attacker can promote their own session or account to instance administrator, entirely bypassing authentication. Vulnerable releases span every branch from 0.58.0 through 0.63.3 (publicly versioned 1.58 and above), across both Metabase Cloud and self-hosted deployments; versions below 58 are unaffected. GHSA-vwf4-m7j8-wcjf gives slightly narrower per-branch affected ranges (0.58.0-0.58.22, 0.59.0-0.59.19, 0.60.0-0.60.15, 0.61.0-0.61.9, 0.62.0-0.62.7, 0.63.0-0.63.2) which this research treats as the authoritative boundary alongside the vendor's own 0.58.0-0.63.3 framing.

Once an attacker holds instance-admin privileges, Metabase's own design makes the blast radius severe: the application stores the connection credentials for every database a customer has wired into it for reporting and analytics. With admin access, the attacker can change application configuration, read those stored credentials, and use them to query connected production databases directly through Metabase's own established connections -- the resulting queries arrive at the downstream database from the legitimate, expected application account, indistinguishable from normal Metabase traffic. There is no malware payload or foreign network indicator to catch, only a distinctive HTTP log signature: a POST to /api/session/reset_password returning HTTP 400 immediately followed by a GET to /api/user/current returning HTTP 200 from the same source/session -- Metabase states plainly that finding this pattern in application or ingress logs means the instance was likely compromised.

Metabase confirmed active exploitation against its own Cloud infrastructure beginning on or before 2026-08-03. On 2026-08-06 Metabase notified Framework, a modular-laptop manufacturer, that its Cloud instance had been vulnerable and accessed; Framework in turn confirmed exposure of customer names, email addresses, phone numbers, physical addresses, login IP addresses, and (for Framework for Business accounts) company names, VAT/EIN numbers, and billing emails -- order and payment data were not affected, and Framework stated the breach affected all customers while it rotated database credentials and engaged third-party forensics. Tally, an online form-builder, confirmed its Metabase analytics environment was compromised the same day the attack began (2026-08-03), with the attacker reaching customer email addresses and password hashes ('password as a cryptographic hash'), though form content and submitted responses were not reached because they are stored separately from the analytics environment. LexisNexis confirmed 'unusual activity on servers that are hosted and managed by a third-party vendor' affecting its Metabase API integration and disconnected the affected systems to contain the issue; the specific scope of any customer-data exposure remains under investigation as of publication and is unrelated to LexisNexis's separate, earlier 2026 AWS/React2Shell breach. No further named victims beyond Framework, Tally, and LexisNexis appear across vendor, wire-service, or independent security-research coverage as of 2026-08-10, and none of the sources reviewed describe evidence of internet-wide scanning for exposed instances -- exploitation is documented only against Metabase's own Cloud-hosted fleet.

No CVE identifier has been assigned to this vulnerability; it is tracked solely via the GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, published 2026-08-06 by GitHub user perivamsi, with no CWE classification listed on the advisory itself (CWE-89 SQL Injection is assigned here as the evidenced root-cause weakness). Because vulnerability scanners that rely purely on NVD/CVE feeds will not flag exposed instances, Metabase's advisory and blog post are the authoritative sources for detection. Metabase patched the flaw and shipped fixed releases (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5), blocked the abused endpoint across its own Cloud fleet, and is urging all self-hosted administrators to upgrade immediately, purge sessions from the core_session table, revoke unrecognized API keys, review administrator-account changes, rotate every credential connected to their instance, and audit data-warehouse/query-history logs and Metabase activity history for unauthorized actions. This is a distinct vulnerability from the unrelated, separately tracked CVE-2026-50148 (Metabase RCE via Snowflake JDBC driver arbitrary file write); the two should not be conflated. No threat-actor attribution has been published for the intrusion.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1098 Account Manipulation
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1538 Cloud Service Dashboard
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service

## Sources

- [SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Security update available for Metabase - Please upgrade now](https://metabase.com/blog/security-update)
- [Framework loses customer data in Metabase zero-day attack](https://www.theregister.com/personal-tech/2026/08/10/framework-loses-customer-data-in-metabase-zero-day-attack/5285302)
- [Framework, Tally disclose Metabase data theft attacks](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)
- [Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access](https://cybersecuritynews.com/metabase-0-day-vulnerability/)
- [Metabase zero-day: data leak through your BI tool](https://hard2bit.com/en/blog/metabase-zero-day-sqli-bi-data-leak-third-party-risk/)
- [Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [Metabase critical security update, password reset endpoint blocked](https://www.clever.cloud/developers/changelog/2026/08-07-metabase-security-reset-password)
- [Tally discloses data breach affecting customer email addresses and password hashes](https://myemailtools.com/tally-data-breach-update/)
- [Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data](https://securityaffairs.com/196874/hacking/metabase-zero-day-exploited-in-the-wild-exposing-admin-access-and-sensitive-data.html)
- [Metabase Zero-Day Attack Lets Hackers Gain Admin Access and Steal Database Credentials](https://cyberpress.org/metabase-zero-day-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1974