# Metabase Unauthenticated SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) Exploited to Steal Connected Database Credentials

> A maximum-severity (CVSS 10.0) unauthenticated SQL injection zero-day in Metabase's /api/session/reset_password endpoint (GHSA-vwf4-m7j8-wcjf, no CVE assigned) was actively exploited beginning around August 2-3, 2026 against Metabase Cloud and self-hosted instances running version 1.58.0 and above, granting attackers full administrator access and the stored credentials of every connected database. Confirmed victims Framework, Tally, n8n, and Kilo Code (Anaconda) disclosed exposure of customer PII, password hashes, and a Slack access token before Metabase patched the flaw and public proof-of-concept exploit code was released on August 10, 2026.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1980
- **ID:** TL-2026-1980
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Metabase, a widely deployed open-source business-intelligence and analytics platform, shipped a critical authentication-bypass flaw in its password-reset flow starting with the 1.58.0 release. The vulnerable handler for POST /api/session/reset_password merges attacker-controlled request data with the (failed) authentication result without validating the resulting user-id. According to Wiz's technical analysis of the patch diff, Metabase's Clojure backend converts the JSON request body into Clojure keywords, so a request body of the form {"user-id": {"raw": "<SQL>"}} becomes {:user-id {:raw "<SQL>"}}. When this unvalidated map reaches the HoneySQL query builder that resolves the target user (t2/select-one [:model/User ...] :id user-id), HoneySQL's :raw directive treats the attacker-supplied string as literal SQL rather than a parameterized integer ID, yielding arbitrary blind SQL injection against the Metabase application database with no authentication and no user interaction. Because the application database also stores the credentials Metabase uses to connect to every data warehouse and database an organization has hooked up to it, a successful injection lets the attacker pivot from an unauthenticated HTTP request to administrator control of the Metabase instance, theft of every connected database's stored credentials, read access to any data those connections can reach, bulk export of that data, and modification of the application's own configuration. Metabase's own patch adds an integer-type check (pos-int? user-id) confirming this root cause.

Metabase disclosed that its own Cloud infrastructure was targeted as a zero-day beginning around August 2-3, 2026, before the company identified and patched the bug; self-hosted instances on 1.58.0 through 1.63.4 were separately exposed once the technique became known. Confirmed downstream victims connected via Metabase Cloud/hosted analytics environments include Framework (laptop manufacturer: names, emails, phone numbers, physical addresses, and login IPs exposed; no payment data), Tally/Tally Forms (email addresses and password hashes exposed; forms/submissions untouched), n8n (136 records of names/emails plus 5 bcrypt-hashed n8n Cloud account passwords exposed via its internal analytics environment), and Kilo Code, an AI coding-agent product owned by Anaconda (partial/full prompts, names, emails, billing addresses, and location data for a subset of users exposed; the Kilo Slackbot's Slack access token was also exposed and immediately invalidated for affected users). Metabase's own vendor guidance for the canonical compromise signature is a POST /api/session/reset_password returning HTTP 400 immediately followed by a GET /api/user/current returning HTTP 200 in web/application logs. By August 10, 2026, public proof-of-concept exploit code had been open-sourced and researchers estimated roughly 25% of internet-reachable Metabase instances (~2,500 hosts observed via Shodan) remained unpatched, indicating continued mass-exploitation risk. No named threat actor or campaign has been attributed to the intrusions as of this writing.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1596.005 Search Open Technical Databases: Scan Databases
- T1190 Exploit Public-Facing Application
- T1098 Account Manipulation
- T1556 Modify Authentication Process
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories

## Sources

- [Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [Metabase SQLi zero-day exploited in customer data-theft attacks](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)
- [SQL injection using an unauthenticated endpoint leading to admin access (GHSA-vwf4-m7j8-wcjf)](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Inside the Metabase SQLi: Exploited in the Wild](https://www.wiz.io/blog/inside-the-metabase-sqli-exploited-in-the-wild)
- [Metabase Patches Vulnerability Exploited as Zero-Day](https://www.securityweek.com/metabase-patches-vulnerability-exploited-as-zero-day/)
- [Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data](https://securityaffairs.com/196874/hacking/metabase-zero-day-exploited-in-the-wild-exposing-admin-access-and-sensitive-data.html)
- [Metabase Incident Impacting Kilo Code Customer Data](https://www.anaconda.com/blog/metabase-incident-impacting-kilo-code-customer-data)
- [Metabase zero-day exploited to access Framework customer data](https://www.helpnetsecurity.com/2026/08/10/metabase-zero-day-framework-tally-kilo-code/)
- [Security update available for Metabase - Please upgrade now](https://www.metabase.com/blog/security-update)
- [Metabase security incident update](https://blog.n8n.io/metabase-security-incident-update/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1980