On August 3, 2026, attackers slipped into a Metabase instance by exploiting a Metabase SQL injection flaw that let them run arbitrary commands without authentication. The breach affected both the SaaS offering and self‑hosted deployments, and it surfaced in the wake of a zero‑day attack that stole customer data from companies like Framework and Tally.
Key Takeaways
- Metabase Cloud and self‑hosted versions 1.58+ are vulnerable to an unauthenticated SQL injection.
- The vulnerability carries a CVSS score of 10.0 and is rated Critical.
- Active exploitation was confirmed; attackers accessed data on August 3, 2026.
- Patches are available for all branches from 0.58 through 0.63; minimum safe releases start at 0.58.24.
- Immediate mitigation includes blocking the
/api/session/reset_passwordendpoint and revoking all active sessions.
Metabase SQL injection zero‑day: What happened
Metabase’s own blog post announced that the company “recently identified that Metabase Cloud was attacked by someone using an unknown (\”0‑day\”) security vulnerability in versions 1.58 and above,” and that the breach was discovered on August 6, 2026. The company didn’t waste time; it blocked the offending endpoints and rolled out a fix the same day.
“We recently identified that Metabase Cloud was attacked by someone using an unknown (\”0‑day\”) security vulnerability in versions 1.58 and above,” Metabase CEO Sameer Al‑Sakran wrote.
That statement set the tone: the flaw was unauthenticated, letting a remote attacker inject arbitrary SQL into the Metabase application database. From there, the attacker could gain administrator rights, alter configuration, steal stored credentials, and export any data reachable through connected databases.
How the vulnerability was exploited
The attack pattern is simple yet effective. First, the attacker sends a POST /api/session/reset_password request that returns a 400 status code. Then, they follow up with a GET /api/user/current request that returns a 200 status code. If logs show that sequence, the system has likely been compromised.
Metabase’s advisory describes the flaw as “an unauthenticated remote attacker [being] able to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance.” That’s why the CVSS rating sits at the maximum of 10.0.
Technical details
- Endpoint used:
/api/session/reset_password - Follow‑up endpoint:
/api/user/current - Required access: None – the endpoint is publicly reachable.
- Potential impact: Full admin control, credential theft, data export.
Because the vulnerability is unauthenticated, there’s no need for a stolen credential to trigger it. That makes it especially dangerous for SaaS providers that expose public APIs.
Immediate impact on Framework and Tally
Framework, the laptop maker, confirmed that attackers stole full names, email addresses, login IPs, billing and shipping details, phone numbers, and company names. For its Business customers, the breach also exposed VAT numbers, EINs, and billing email addresses.
Tally, the online form builder, reported that the attackers accessed email addresses and password hashes. The company clarified that the hashes are one‑way and can’t be reversed, and that form responses weren’t compromised.
Both companies received the breach notifications on August 6, 2026, and they traced the intrusion back to the Metabase zero‑day that was active on August 3, 2026.
Patch rollout and remediation steps
Metabase moved quickly. All Cloud customers were upgraded automatically, and the company published patched versions for every affected branch. The minimum safe releases are:
- 0.58.24
- 0.59.21
- 0.60.17
- 0.61.11
- 0.62.9
- 0.63.5
If you can’t upgrade immediately, Metabase advises blocking the /api/session/reset_password endpoint. After upgrading, you should revoke all active user sessions by deleting rows in the core_session table, review API keys, audit administrator accounts, rotate database credentials, and scan logs for suspicious activity.
Step‑by‑step guide
- Block the vulnerable endpoint at the firewall or reverse proxy.
- Upgrade to the latest point release for your major version.
- Delete all rows in
core_sessionto force logout. - Audit API keys for unknown entries.
- Rotate passwords for every connected data source.
- Check data‑warehouse logs for unauthorized queries.
Metabase also warned that logs showing the attack pattern are likely compromised, so you’ll need to rely on external monitoring or backup logs to confirm exposure.
Broader implications for SaaS security
This incident highlights how a single unauthenticated endpoint can become a foothold for massive data theft. It’s a reminder that even well‑known platforms must treat every public API as a potential attack surface.
For developers, the lesson is clear: regular dependency audits, continuous monitoring of API traffic, and rapid patch deployment are non‑negotiable. If you’re running Metabase on‑premises, you’ve got to stay on top of version upgrades, because the company’s advisory makes it clear that older point releases remain vulnerable.
LexisNexis, another Metabase user, reported disruption to its Diligence, Metabase API, and Newsdesk services after detecting “unusual activity on servers that are hosted and managed by a third‑party vendor.” While LexisNexis didn’t directly tie the issue to the zero‑day, the timing suggests a broader supply‑chain ripple.
Historical Context
Metabase has been a staple of data‑driven teams for years. Its open‑source roots mean that many organizations adopt it without a dedicated security team. Over time, the project has released multiple security advisories, each prompting users to upgrade. Those past notices taught the community that even modest changes can open a back door if not patched quickly.
Earlier incidents involved less severe exposure, such as cross‑site scripting or privilege‑escalation bugs. Those flaws required authentication or a specific user action. The current zero‑day differs because it removes the need for any credential at all. That shift raises the stakes for every deployment, whether running in the cloud or on‑prem.
Because Metabase’s codebase is publicly visible, attackers can study it for weaknesses. Open‑source projects benefit from community scrutiny, but they also give adversaries a roadmap. The pattern of recurring vulnerabilities underscores why a disciplined upgrade cadence is more than a best practice—it’s a survival tactic.
Organizations that have historically deferred updates often find themselves scrambling after a breach. The Metabase episode reinforces that habit‑breaking is essential. When a patch lands, the window for exploitation can shrink dramatically if teams act fast.
What This Means For You
If you’re a developer or founder relying on Metabase for analytics, you need to verify your version today. Check the “About Metabase” screen or run metabase --version and compare against the safe releases listed above. If you’re below the minimum, lock down the /api/session/reset_password endpoint and schedule an upgrade within 24 hours.
Beyond the immediate fix, consider adding WAF rules that detect the POST‑400 followed by GET‑200 pattern. Those signatures can flag an ongoing exploit before it reaches your database. And remember to rotate any stored credentials that could have been exfiltrated – that’s the only way to limit downstream risk.
Going forward, the Metabase incident will likely push SaaS providers to reevaluate how they expose authentication‑related endpoints. Will we see stricter default rate‑limiting or mandatory authentication on password‑reset APIs? Only, but the pressure to harden public APIs is certainly mounting.
Competitive Landscape
Metabase sits among a crowded field of analytics tools. Competitors often tout ease of deployment and low‑cost licensing. However, the current breach puts a spotlight on how quickly an attractive price point can become a liability if security isn’t baked in.
Customers now have use to demand stronger guarantees from any vendor that offers a public API. Expect more providers to publish their own security roadmaps, and to adopt stricter default configurations around password‑reset flows. Those shifts could reshape the market, nudging buyers toward solutions that already enforce multi‑factor authentication or limit endpoint exposure.
Existing users of alternative platforms will likely audit their own setups for similar gaps. The industry’s response may include a wave of third‑party security audits, especially for tools that sit at the intersection of data access and user‑facing dashboards. Those audits can surface hidden risks before attackers get a chance to exploit them.
What Happens Next
Metabase has pledged to monitor for any lingering threats. The company’s security team will continue reviewing logs for the tell‑tale request pattern and will release follow‑up guidance if new attack vectors emerge.
For the broader ecosystem, the incident serves as a catalyst for tighter API hygiene. Expect conferences to feature more talks on unauthenticated endpoints, and open‑source maintainers to tighten contribution guidelines around input validation. Those cultural changes take time, but they start with the kind of concrete steps outlined.
In the short term, the biggest win will be rapid adoption of the patched releases. Teams that move fast will reduce the attack surface dramatically. Those that lag risk staying exposed long after the headline fades.
Sources: BleepingComputer, Metabase security advisory
Primary sources: github.com (Primary source linked by the report), metabase.com (Primary source linked by the report).
