Metabase Unauthenticated SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) Exploited to Steal Connected Database Credentials
Metabase Unauthenticated SQL Injection Zero-Day (TL-2026-1980) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-10. It has no confirmed attribution, affects Metabase Metabase (self-hosted, open source & enterprise), maps to 9 MITRE ATT&CK techniques (T1098, T1190, T1213), and is covered by 9 detection rules and 12 indicators of compromise.
Key facts for TL-2026-1980
- Threat ID
- TL-2026-1980
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software, manufacturing
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Metabase Unauthenticated SQL Injection Zero-Day
Malware and tooling: Shodan
A maximum-severity (CVSS 10.0) unauthenticated SQL injection zero-day in Metabase's /api/session/reset_password endpoint (GHSA-vwf4-m7j8-wcjf, no CVE assigned) was actively exploited beginning around August 2-3, 2026 against Metabase Cloud and self-hosted instances running version 1.58.0 and above, granting attackers full administrator access and the stored credentials of every connected database. Confirmed victims Framework, Tally, n8n, and Kilo Code (Anaconda) disclosed exposure of customer PII, password hashes, and a Slack access token before Metabase patched the flaw and public proof-of-concept exploit code was released on August 10, 2026.
How Metabase Unauthenticated SQL Injection Zero-Day works
Metabase, a widely deployed open-source business-intelligence and analytics platform, shipped a critical authentication-bypass flaw in its password-reset flow starting with the 1.58.0 release. The vulnerable handler for POST /api/session/reset_password merges attacker-controlled request data with the (failed) authentication result without validating the resulting user-id. According to Wiz's technical analysis of the patch diff, Metabase's Clojure backend converts the JSON request body into Clojure keywords, so a request body of the form {"user-id": {"raw": "<SQL>"}} becomes {:user-id {:raw "<SQL>"}}. When this unvalidated map reaches the HoneySQL query builder that resolves the target user (t2/select-one [:model/User ...] :id user-id), HoneySQL's :raw directive treats the attacker-supplied string as literal SQL rather than a parameterized integer ID, yielding arbitrary blind SQL injection against the Metabase application database with no authentication and no user interaction. Because the application database also stores the credentials Metabase uses to connect to every data warehouse and database an organization has hooked up to it, a successful injection lets the attacker pivot from an unauthenticated HTTP request to administrator control of the Metabase instance, theft of every connected database's stored credentials, read access to any data those connections can reach, bulk export of that data, and modification of the application's own configuration. Metabase's own patch adds an integer-type check (pos-int? user-id) confirming this root cause.
Metabase disclosed that its own Cloud infrastructure was targeted as a zero-day beginning around August 2-3, 2026, before the company identified and patched the bug; self-hosted instances on 1.58.0 through 1.63.4 were separately exposed once the technique became known. Confirmed downstream victims connected via Metabase Cloud/hosted analytics environments include Framework (laptop manufacturer: names, emails, phone numbers, physical addresses, and login IPs exposed; no payment data), Tally/Tally Forms (email addresses and password hashes exposed; forms/submissions untouched), n8n (136 records of names/emails plus 5 bcrypt-hashed n8n Cloud account passwords exposed via its internal analytics environment), and Kilo Code, an AI coding-agent product owned by Anaconda (partial/full prompts, names, emails, billing addresses, and location data for a subset of users exposed; the Kilo Slackbot's Slack access token was also exposed and immediately invalidated for affected users). Metabase's own vendor guidance for the canonical compromise signature is a POST /api/session/reset_password returning HTTP 400 immediately followed by a GET /api/user/current returning HTTP 200 in web/application logs. By August 10, 2026, public proof-of-concept exploit code had been open-sourced and researchers estimated roughly 25% of internet-reachable Metabase instances (~2,500 hosts observed via Shodan) remained unpatched, indicating continued mass-exploitation risk. No named threat actor or campaign has been attributed to the intrusions as of this writing.
MITRE ATT&CK techniques used in TL-2026-1980
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Discovery
Credential Access
T1552 Unsecured Credentials; T1556 Modify Authentication Process
Reconnaissance
T1592.002 Gather Victim Host Information: Software; T1595.002 Active Scanning: Vulnerability Scanning; T1596.005 Search Open Technical Databases: Scan Databases
Affected products and versions in Metabase Unauthenticated SQL Injection Zero-Day
- Metabase — Metabase (self-hosted, open source & enterprise)
Vulnerable versions: 1.58.0-1.58.23; 1.59.0-1.59.20; 1.60.0-1.60.16; 1.61.0-1.61.10; 1.62.0-1.62.8; 1.63.0-1.63.4
Fixed in: 1.58.24; 1.59.21; 1.60.17; 1.61.11; 1.62.9; 1.63.5 - Metabase — Metabase Cloud
Vulnerable versions: all Cloud tenants prior to vendor-side patch
Fixed in: patched fleet-wide by Metabase as of 2026-08-06
Remediation for Metabase Unauthenticated SQL Injection Zero-Day
Patches
- 1.58.24
- 1.59.21
- 1.60.17
- 1.61.11
- 1.62.9
- 1.63.5
Immediate actions
- Upgrade self-hosted Metabase to the minimum-safe release for your branch: 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5
- If immediate upgrade is not possible, block public access to POST /api/session/reset_password at the reverse proxy/WAF
Workarounds
- Temporarily block/deny public access to POST /api/session/reset_password until patched
Longer-term hardening
- Revoke all active Metabase sessions and rotate every credential stored in Metabase for connected databases/data warehouses
- Audit administrator accounts and delete any unrecognized API keys
- Review connected-database access logs and Metabase query history for anomalous activity coinciding with the compromise window
Timeline of Metabase Unauthenticated SQL Injection Zero-Day
- Attackers exploit the unauthenticated SQL injection zero-day against Metabase Cloud infrastructure over an approximately 4-hour window, per Anaconda's Kilo Code incident disclosure.
- Attackers exploit the same zero-day against Metabase Cloud-connected instances tied to Framework and Tally, per BleepingComputer and The Hacker News reporting.
- Metabase blocks the abused /api/session/reset_password endpoint, patches Metabase Cloud fleet-wide, and publishes GHSA-vwf4-m7j8-wcjf with fixed self-hosted releases 1.58.24-1.63.5.
- Metabase notifies affected downstream customers, including Framework, n8n, and Kilo Code/Anaconda, of the compromise.
- BleepingComputer publishes the first detailed report on the Framework and Tally customer data-theft attacks.
- n8n publicly discloses that attackers accessed 136 customer records (names/emails) and 5 bcrypt-hashed n8n Cloud account passwords via its Metabase-based internal analytics environment.
- Anaconda publishes an update on the Kilo Code incident, confirming exposure of prompts, user data, and Slack access tokens for a subset of users, and invalidates all affected Slackbot tokens.
- Public proof-of-concept exploit code for GHSA-vwf4-m7j8-wcjf is open-sourced; Wiz and Help Net Security publish deep-dive technical analyses noting roughly 2,500 internet-exposed Metabase instances (~25% of the observed population) remain unpatched.
Sources cited for Metabase Unauthenticated SQL Injection Zero-Day
- Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
- Metabase SQLi zero-day exploited in customer data-theft attacks
- SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)
- Inside the Metabase SQLi: Exploited in the Wild
- Metabase Patches Vulnerability Exploited as Zero-Day
- Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data
- Metabase Incident Impacting Kilo Code Customer Data
- Metabase zero-day exploited to access Framework customer data
- Security update available for Metabase - Please upgrade now
- Metabase security incident update
Threats related to Metabase Unauthenticated SQL Injection Zero-Day
- Critical Metabase Zero-Day (CVE-2026-72898): Unauthenticated SQL Injection Grants Admin Access, Exploited in the Wild
- Metabase Unauthenticated SQL Injection 0-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Admin Takeover
- Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Unauthenticated Admin Access
- Unauthenticated SQL Injection Zero-Day in Metabase (CVSS 10.0, GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework, Tally, and LexisNexis Customer Data
- Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf): Unauthenticated SQL Injection via /api/session/reset_password Exploited to Steal Database Credentials
- Metabase Zero-Day SQL Injection (GHSA-vwf4-m7j8-wcjf) Exploited In the Wild for Admin Access
Detection coverage for TL-2026-1980
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1980 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.