Critical Zero-Day Exploit in Metabase Grants Attackers Full Admin Access
Metabase, a popular open-source business intelligence and data visualization platform, has confirmed active exploitation of a critical zero-day vulnerability (GHSA-vwf4-m7j8-wcjf) allowing unauthenticated attackers to gain full administrator control of affected instances. The flaw, rated with a maximum CVSS score of 10.0, impacts all versions from 0.58 through 0.63.
The vulnerability is an unauthenticated SQL injection in the publicly accessible POST /api/session/reset_password endpoint. Attackers can inject arbitrary SQL commands into Metabase’s database, manipulate records, and escalate privileges to an admin account. From there, they can extract stored credentials, access connected databases, and exfiltrate sensitive data.
Metabase first detected the exploit on August 3, when its own cloud platform was breached. The company patched the flaw within hours, automatically securing all Metabase Cloud customers. However, self-hosted deployments remain vulnerable until administrators apply the fix.
At least two companies Framework and Tally have reported data breaches linked to this zero-day, with unauthorized access to customer information, including names, addresses, phone numbers, and emails.
Security teams can detect exploitation by checking logs for a specific pattern: a POST /api/session/reset_password request returning a 400 status code, followed by a GET /api/user/current request returning 200. This sequence indicates successful session hijacking, and affected instances should be considered compromised.
Metabase has released patched versions (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5) for self-hosted deployments. Organizations running older versions (pre-0.58) are unaffected. If the vulnerable endpoint was exposed, security teams should revoke active sessions, audit API keys, review admin accounts, rotate database credentials, and inspect logs for unauthorized activity.
Given Metabase’s role as a central data hub, this flaw poses severe risks, potentially enabling broader breaches across connected systems. Self-hosted users are urged to patch immediately.
Source: https://cybersecuritynews.com/metabase-0-day-vulnerability/
Metabase cybersecurity rating report: https://www.rankiteo.com/company/metabase
"id": "MET1786299845",
"linkid": "metabase",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'All self-hosted deployments '
'(versions 0.58-0.63)',
'industry': 'Business Intelligence / Data '
'Visualization',
'name': 'Metabase',
'type': 'Software Vendor'},
{'customers_affected': 'Yes (data breach reported)',
'name': 'Framework',
'type': 'Company'},
{'customers_affected': 'Yes (data breach reported)',
'name': 'Tally',
'type': 'Company'}],
'attack_vector': 'Unauthenticated SQL Injection',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes (names, '
'addresses, phone '
'numbers, emails)',
'sensitivity_of_data': 'High (PII, credentials)',
'type_of_data_compromised': ['Customer information (names, '
'addresses, phone numbers, '
'emails)',
'Stored credentials',
'Connected database access']},
'date_detected': '2024-08-03',
'description': 'Metabase, a popular open-source business intelligence and '
'data visualization platform, has confirmed active '
'exploitation of a critical zero-day vulnerability '
'(GHSA-vwf4-m7j8-wcjf) allowing unauthenticated attackers to '
'gain full administrator control of affected instances. The '
'flaw, rated with a maximum CVSS score of 10.0, impacts all '
'versions from 0.58 through 0.63. The vulnerability is an '
'unauthenticated SQL injection in the publicly accessible '
'*POST /api/session/reset_password* endpoint. Attackers can '
'inject arbitrary SQL commands into Metabase’s database, '
'manipulate records, and escalate privileges to an admin '
'account. From there, they can extract stored credentials, '
'access connected databases, and exfiltrate sensitive data.',
'impact': {'brand_reputation_impact': 'Severe risk due to central data hub '
'role',
'data_compromised': 'Customer information (names, addresses, phone '
'numbers, emails), stored credentials, '
'connected database access',
'identity_theft_risk': 'High (PII exposed)',
'operational_impact': 'Full administrator control gained by '
'attackers, potential broader breaches '
'across connected systems',
'systems_affected': 'Metabase instances (versions 0.58 through '
'0.63)'},
'initial_access_broker': {'entry_point': 'Publicly accessible *POST '
'/api/session/reset_password* '
'endpoint'},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'corrective_actions': 'Patch released, session '
'revocation, credential '
'rotation, log audits',
'root_causes': 'Unauthenticated SQL injection '
'vulnerability in Metabase’s *POST '
'/api/session/reset_password* '
'endpoint'},
'recommendations': 'Self-hosted users should patch immediately to versions '
'0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5. '
'Revoke active sessions, audit API keys, review admin '
'accounts, rotate database credentials, and inspect logs '
'for unauthorized activity.',
'references': [{'source': 'Metabase Security Advisory'}],
'response': {'containment_measures': 'Patch released (versions 0.58.24, '
'0.59.21, 0.60.17, 0.61.11, 0.62.9, '
'0.63.5)',
'enhanced_monitoring': 'Log checks for *POST '
'/api/session/reset_password* (400 '
'status) followed by *GET '
'/api/user/current* (200 status)',
'incident_response_plan_activated': 'Yes (patch released within '
'hours for Metabase Cloud)',
'remediation_measures': 'Revoke active sessions, audit API keys, '
'review admin accounts, rotate database '
'credentials, inspect logs for '
'unauthorized activity'},
'title': 'Critical Zero-Day Exploit in Metabase Grants Attackers Full Admin '
'Access',
'type': 'Zero-Day Exploit',
'vulnerability_exploited': 'GHSA-vwf4-m7j8-wcjf (CVSS 10.0)'}