Technical Product Lead

Metabase patches zero-day SQL injection vulnerability. Metabase released urgent patches for a zero-day SQL injection that allowed unauthenticated attackers to inject SQL and gain administrative access; Cloud instances are updated and self-hosted users must patch. Metabase released urgent patches for a critical SQL injection vulnerability that was exploited in the wild. Metabase Cloud instances have already been updated. Self-hosted users are urged to apply the vendor's patches or use a temporary workaround until they can update. The vulnerability was discovered after a threat actor exploited it in an attack against Metabase Cloud. The company blocked the endpoints used in the intrusion and produced fixes for affected releases. A CVE identifier has not been assigned. Patched builds are listed as versions 63.5, 62.9, 61.11, 60.17, 59.21 and 58.24. The flaw allows remote, unauthenticated attackers to inject arbitrary SQL into the Metabase application. The advisory warned that an attacker who gains that access could obtain full administrative control, change application configuration, steal stored credentials for connected databases, read data available through those connections, and export data. The advisory stated that Metabase identified and patched the issue quickly after blocking the endpoints used in the attack. Metabase recommends that self-hosted administrators apply the released patches as soon as possible. Where immediate patching is not feasible, the vendor advises blocking the /api/session/reset_password endpoint as a temporary workaround. After applying patches, administrators should revoke all active user sessions, remove any unrecognized API keys, inspect administrative accounts for unauthorized changes, rotate credentials used by connected databases, and review logs and Metabase activity for suspicious access. To help detect potential compromises, Metabase pointed to a specific log pattern: a "POST /api/session/reset_password" request returning a 400 status code followed by a "GET /api/user/current" request returning 200. Finding that sequence in application or ingress logs likely indicates the instance was compromised. Administrators unable to update immediately are advised to isolate affected instances from the internet until they can apply the patched releases and complete the cleanup and verification steps outlined in the advisory.

Metabase 0-day flaw exploited in attack to inject arbitrary SQL and steal database credentials. August 10, 2026 Metabase has reported a critical security incident involving a zero-day vulnerability that is actively being exploited. This vulnerability affects self-hosted deployments running version 1.58 and later. Cloud security certification Discover more Antivirus & Malware According to the company, an attacker exploited this previously unknown flaw to target Metabase Cloud before the vulnerable endpoints were blocked and a patch was developed. Customers using Metabase Cloud have already been upgraded and are now protected. However, organizations running their own Metabase instances may still be at risk until they install a secure point release. Metabase 0-day flaw. This vulnerability allows an attacker who gains access to a compromised Metabase deployment to inject arbitrary SQL queries into the Metabase application database. This could grant them administrator-level access to the instance, allowing them to modify application settings. From this point, attackers may be able to steal credentials stored for connected databases, access data available through those connections, and export sensitive information. This issue poses a particular risk for organizations that use Metabase as a central analytics platform connected to production databases, cloud warehouses, and other critical data sources. Metabase indicated that the exposed attack surface is linked to the /api/session/reset_password endpoint. Administrators should evaluate whether this endpoint has been publicly accessible and review logs for indications of attempted or successful exploitation. Discover more Penetration testing services Malware removal software Attack Pattern and Detection The vendor identified a specific sequence that may indicate compromise: * A POST /api/session/reset_password request returning HTTP 400. * A subsequent GET /api/user/current request returning HTTP 200. Organizations that identify this pattern in Metabase application logs, reverse-proxy logs, or ingress logs should treat the instance as potentially compromised and initiate incident response procedures. The advisory states that versions prior to Metabase 58 are not affected. However, deployments running version 58 or later must upgrade to the latest safe point release in their release branch. Metabase has published the following minimum patched versions: Organizations using Metabase version 0.58.6 must upgrade to version 0.58.24 or a later supported release. Docker users should pull the corresponding patched `metabase/metabase` image, while JAR-based deployments should replace the existing application package with the updated version. Discover more Dark web monitoring Threat intelligence reports Cyberattack prevention tools After the upgrade, administrators whose password-reset endpoint was accessible over the Internet should revoke existing user sessions by deleting entries from the `core_session` table in the Metabase application database. They should also review API keys, check administrator accounts for any unauthorized changes, and delete unfamiliar keys. Since the flaw may expose stored database credentials, affected organizations should rotate the credentials for every connected database. Additionally, security teams should inspect data warehouse audit logs, Metabase activity records, and query history for any suspicious access, exports, or unexpected SQL activity. Cloud security certification Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world. Hot this week

Metabase zero-day exploited in wild allows admin access without authentication. Ravie LakshmananAug 08, 2026 Zero-Day / Vulnerability Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain administrator access to the instance. Armed with the elevated access, the attacker can change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above," Metabase said in an advisory. Metabase Cloud instances have already been updated to the latest version. Users running self-hosted versions are advised to apply security patches released by Metabase with immediate effect. The following versions are affected - * >= x.58.0, < x.58.23 (Fixed in x.58.24) * >= x.59.0, < x.59.20 (Fixed in x.59.21) * >= x.60.0, < x.60.16 (Fixed in x.60.17) * >= x.61.0, < x.61.10 (Fixed in x.61.11) * >= x.62.0, < x.62.8 (Fixed in x.62.9) * >= x.63.0, < x.63.3 (Fixed in x.63.5) As a temporary workaround until the fixes can be applied, it's advised to block the "/api/session/reset_password" endpoint. Once the update is complete, customers who have their "/api/session/reset_password" endpoint publicly accessible are advised to perform the following steps - * Revoke all active user sessions by accessing the Metabase Application Database and deleting all rows in the core_session table * Review API keys and delete any unrecognized keys * Review administrator accounts for any unexpected changes * Rotate credentials for any of the connected databases * Review data warehouse logs for any sign of unauthorized access * Review Metabase activity and query history for unexpected or unauthorized activity Metabase has not shared any specifics about the malicious activity, but shared the following indicators of compromise (IoCs) - * A call to "POST /api/session/reset_password" with a 400 status code * This is followed by a call to "GET /api/user/current" with a 200 status code "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised," Metabase CEO Sameer Al-Sakran said. One of the companies that has been affected is Framework. According to Engadget, the PC maker alerted all its customers that customer names, login IPs, addresses, phone numbers, and emails were accessed during the hack. It noted that no order or payment information was accessed. Exactly three years ago, Metabase moved to address another "extremely severe" flaw (CVE-2023-38646, CVSS score: 9.8) that could have resulted in pre-authenticated remote code execution on affected installations. Found this article interesting? Follow ASMGi on Google News, Twitter and LinkedIn to read more exclusive content ASMGi post.