CVSS score: 10.0 — Metabase has warned that a maximum-severity, in-the-wild zero-day allows unauthenticated attackers to inject arbitrary SQL and escalate to administrator access on affected instances.
How the flaw works and what an attacker can do
According to Metabase, the vulnerability lets an unauthenticated remote actor inject arbitrary SQL into the Metabase application database. That injection can be used to gain administrator access to the instance. With administrator privileges, an attacker can change application configuration, steal stored credentials for connected databases, read any data accessible through those connections, and export data.
Which Metabase releases are affected and where fixes landed
Metabase identified the problem as a zero-day without a CVE identifier and assigned a CVSS score of 10.0. The company said Metabase Cloud instances were attacked but have already been updated to the latest version. Self-hosted users are urged to apply Metabase's security patches immediately. The affected and fixed ranges published by Metabase are:
- >= x.58.0, < x.58.23 — fixed in x.58.24
- >= x.59.0, < x.59.20 — fixed in x.59.21
- >= x.60.0, < x.60.16 — fixed in x.60.17
- >= x.61.0, < x.61.10 — fixed in x.61.11
- >= x.62.0, < x.62.8 — fixed in x.62.9
- >= x.63.0, < x.63.3 — fixed in x.63.5
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadIndicators of compromise and recommended immediate actions
Metabase published two indicators of compromise (IoCs) tied to the attack pattern: a call to "POST /api/session/reset_password" returning a 400 status code, followed by a "GET /api/user/current" returning 200. "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised," Metabase CEO Sameer Al-Sakran said.
As a temporary mitigation until patches are applied, Metabase advised blocking the "/api/session/reset_password" endpoint. After applying updates, customers who had that endpoint publicly accessible are advised to:
- Revoke all active user sessions by accessing the Metabase Application Database and deleting all rows in the core_session table
- Review API keys and delete any unrecognized keys
- Review administrator accounts for any unexpected changes
- Rotate credentials for any of the connected databases
- Review data warehouse logs for any sign of unauthorized access
- Review Metabase activity and query history for unexpected or unauthorized activity
Concrete impact: Framework disclosed customer data access
Metabase said one company affected by the compromise is Framework. Reporting cited by Engadget shows Framework alerted customers that customer names, login IPs, addresses, phone numbers, and emails were accessed during the hack. Framework noted that no order or payment information was accessed.
What this means for security teams, enterprise customers, and end users
Security teams should prioritize confirming whether their instances show the IoC pattern and immediately apply the version fixes listed above or block the exposed endpoint as a temporary stopgap. They will need to follow the post-patch actions Metabase published — session revocation, API key and admin-account review, credential rotation, and log examinations — to determine the scope of any exposure.
Enterprise procurement and IT leaders running self-hosted Metabase must inventory deployments against the affected version ranges and coordinate urgent patching. Organizations that integrate Metabase with critical data stores have an immediate need to rotate connected-database credentials and review data-warehouse access logs for possible exfiltration.
End users whose data is surfaced through Metabase-connected systems may be affected indirectly if administrators did not patch promptly; Framework's disclosure that names, IPs, addresses, phone numbers, and emails were accessed illustrates the types of customer metadata that can be exposed even when payment or order records remain untouched.
Metabase also noted a precedent: three years ago the project addressed an "extremely severe" flaw (CVE-2023-38646, CVSS score: 9.8) that could have allowed pre-authenticated remote code execution. Today’s zero-day, Metabase says, was detected and triggers the same rapid remediation and disclosure process: cloud instances were updated centrally and self-hosted instances must apply patches and complete the post-update hygiene steps.
For administrators the immediate question is straightforward and actionable: check logs for the POST /api/session/reset_password → GET /api/user/current pattern, patch to the fixed release for your release line, and follow the revocation and review steps Metabase provided. Those steps will determine whether an intrusion was limited or required further containment and investigation.
https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html
