Metabase 0-day flaw exploited in attack to inject arbitrary SQL and steal database credentials. August 10, 2026 Metabase has reported a critical security incident involving a zero-day vulnerability that is actively being exploited. This vulnerability affects self-hosted deployments running version 1.58 and later. Cloud security certification Discover more Antivirus & Malware According to the company, an attacker exploited this previously unknown flaw to target Metabase Cloud before the vulnerable endpoints were blocked and a patch was developed. Customers using Metabase Cloud have already been upgraded and are now protected. However, organizations running their own Metabase instances may still be at risk until they install a secure point release. Metabase 0-day flaw. This vulnerability allows an attacker who gains access to a compromised Metabase deployment to inject arbitrary SQL queries into the Metabase application database. This could grant them administrator-level access to the instance, allowing them to modify application settings. From this point, attackers may be able to steal credentials stored for connected databases, access data available through those connections, and export sensitive information. This issue poses a particular risk for organizations that use Metabase as a central analytics platform connected to production databases, cloud warehouses, and other critical data sources. Metabase indicated that the exposed attack surface is linked to the /api/session/reset_password endpoint. Administrators should evaluate whether this endpoint has been publicly accessible and review logs for indications of attempted or successful exploitation. Discover more Penetration testing services Malware removal software Attack Pattern and Detection The vendor identified a specific sequence that may indicate compromise: * A POST /api/session/reset_password request returning HTTP 400. * A subsequent GET /api/user/current request returning HTTP 200. Organizations that identify this pattern in Metabase application logs, reverse-proxy logs, or ingress logs should treat the instance as potentially compromised and initiate incident response procedures. The advisory states that versions prior to Metabase 58 are not affected. However, deployments running version 58 or later must upgrade to the latest safe point release in their release branch. Metabase has published the following minimum patched versions: Organizations using Metabase version 0.58.6 must upgrade to version 0.58.24 or a later supported release. Docker users should pull the corresponding patched `metabase/metabase` image, while JAR-based deployments should replace the existing application package with the updated version. Discover more Dark web monitoring Threat intelligence reports Cyberattack prevention tools After the upgrade, administrators whose password-reset endpoint was accessible over the Internet should revoke existing user sessions by deleting entries from the `core_session` table in the Metabase application database. They should also review API keys, check administrator accounts for any unauthorized changes, and delete unfamiliar keys. Since the flaw may expose stored database credentials, affected organizations should rotate the credentials for every connected database. Additionally, security teams should inspect data warehouse audit logs, Metabase activity records, and query history for any suspicious access, exports, or unexpected SQL activity. Cloud security certification Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world. Hot this week

Metabase zero-day exploited in wild allows admin access without authentication. Ravie LakshmananAug 08, 2026 Zero-Day / Vulnerability Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain administrator access to the instance. Armed with the elevated access, the attacker can change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above," Metabase said in an advisory. Metabase Cloud instances have already been updated to the latest version. Users running self-hosted versions are advised to apply security patches released by Metabase with immediate effect. The following versions are affected - * >= x.58.0, < x.58.23 (Fixed in x.58.24) * >= x.59.0, < x.59.20 (Fixed in x.59.21) * >= x.60.0, < x.60.16 (Fixed in x.60.17) * >= x.61.0, < x.61.10 (Fixed in x.61.11) * >= x.62.0, < x.62.8 (Fixed in x.62.9) * >= x.63.0, < x.63.3 (Fixed in x.63.5) As a temporary workaround until the fixes can be applied, it's advised to block the "/api/session/reset_password" endpoint. Once the update is complete, customers who have their "/api/session/reset_password" endpoint publicly accessible are advised to perform the following steps - * Revoke all active user sessions by accessing the Metabase Application Database and deleting all rows in the core_session table * Review API keys and delete any unrecognized keys * Review administrator accounts for any unexpected changes * Rotate credentials for any of the connected databases * Review data warehouse logs for any sign of unauthorized access * Review Metabase activity and query history for unexpected or unauthorized activity Metabase has not shared any specifics about the malicious activity, but shared the following indicators of compromise (IoCs) - * A call to "POST /api/session/reset_password" with a 400 status code * This is followed by a call to "GET /api/user/current" with a 200 status code "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised," Metabase CEO Sameer Al-Sakran said. One of the companies that has been affected is Framework. According to Engadget, the PC maker alerted all its customers that customer names, login IPs, addresses, phone numbers, and emails were accessed during the hack. It noted that no order or payment information was accessed. Exactly three years ago, Metabase moved to address another "extremely severe" flaw (CVE-2023-38646, CVSS score: 9.8) that could have resulted in pre-authenticated remote code execution on affected installations. Found this article interesting? Follow ASMGi on Google News, Twitter and LinkedIn to read more exclusive content ASMGi post.

Framework laptops suffers massive data breach via third-party zero-day exploit. Moaataz Anwar August 08, 2026 0 Comments Framework, the hardware manufacturer widely recognized for its modular and highly repairable laptops, has officially begun issuing data breach notifications to its entire user base. The company confirmed that malicious hackers managed to exfiltrate sensitive customer identification records following a sophisticated cyberattack targeted at an upstream business intelligence provider. The Scope of Exfiltrated Customer Data The security incident came to light after multiple Framework users took to social media channels to share copy-pasted security alerts sent by the hardware firm. Speaking to technology reporters, a Framework spokesperson confirmed that the data breach compromised personal information across "all customers." While the consumer electronics brand officially declined to specify the exact volume of compromised accounts, historical market metrics estimate that the niche hardware brand has deployed hundreds of thousands of modular computers globally. According to the official notification logs, the stolen data sets include: - Full Legal Names: The primary identities of registered buyers. - Contact Details: Active electronic mail addresses and telephone records. - Logistics Information: Verifiable physical billing and home shipping addresses. - Financial Exclusions: Framework explicitly noted that its core transaction systems and customer payment card details were completely unaffected, as they are isolated from the breached server infrastructure. The Root Cause: An Upstream Zero-Day Attack Framework has pinned the operational responsibility for the data exposure on a severe supply-chain cyberattack at Metabase, an external software company that provides cloud-hosted business intelligence and data visualization services to the laptop maker. Metabase disclosed the underlying mechanics of the infrastructure breach via a security bulletin on its official corporate blog. According to the software firm, hackers successfully leveraged a previously unpatched software vulnerability - frequently referred to in cybersecurity circles as a zero-day exploit. The cybercriminals weaponized this system flaw to bypass standard authentication security blocks, granting them deep administrative entry into the proprietary customer databases hosted directly on Metabase's enterprise cloud servers. System Investigations and Corporate Silence In the security warnings distributed to device owners, Framework included the technical advisory text that Metabase had privately forwarded to the company confirming unauthorized access to Framework's cloud instance. Following an immediate internal telemetry audit, Framework's cybersecurity teams verified that the digital intruders used this cloud access loop to clone the repository containing customer address books. At the time of compilation, Metabase executives have not responded to public inquiries regarding the specific identity of the hacking group or the current patch status of the zero-day vulnerability. Framework continues to advise its community to remain highly vigilant against potential phishing campaigns or unsolicited communication attempting to exploit the leaked email databases and personal addresses. Posted bymoaataz Anwar.