Metabase CVSS 10 SQL Injection Zero-Day Hits Admin Access

The Metabase CVSS 10 SQL injection zero-day lets an unauthenticated attacker turn a self-hosted analytics dashboard into a master key for every database it touches. Active exploitation began August 3, 2026, and two named victims — Framework and Tally — have already confirmed customer data theft. If your organization runs Metabase for internal reporting, this is not a “patch when convenient” bug.

What Happened

Metabase, the widely used open-source business intelligence platform, disclosed an unauthenticated SQL injection vulnerability in its POST /api/session/reset_password endpoint, tracked as GHSA-vwf4-m7j8-wcjf with a maximum CVSS score of 10.0. No CVE number has been assigned as of this writing, so the flaw does not yet appear in any vendor CVE database or CISA’s KEV catalog — do not wait for one before acting.

A remote attacker with zero credentials can inject arbitrary SQL into Metabase’s own application database through the vulnerable endpoint. From there, the attacker escalates to full Metabase administrator privileges and can read or export data — and steal the stored connection credentials — for every external database Metabase has been configured to query. The flaw affects Metabase Open Source versions 0.58.x through 0.63.x and the equivalent Enterprise/Pro branches from 1.58.x onward. Metabase Cloud infrastructure was the first confirmed target, with exploitation beginning around August 3, 2026.

Fixed releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 for Open Source (Enterprise builds carry the equivalent version number one major digit higher). Framework, the maker of modular repairable laptops, and business software vendor Tally have both confirmed that customer data — names, email addresses, phone numbers, and physical addresses — was stolen through compromised Metabase instances connected to their customer databases.

Why It Matters

Business intelligence tools like Metabase are frequently deployed with standing, high-privilege connections to production databases — customer records, billing systems, HR data — because that access is the entire point of the tool. That same access is exactly what makes a compromised BI instance catastrophic: the attacker doesn’t need to breach your database directly, they only need to breach the dashboard sitting in front of it. In many organizations, self-hosted analytics tools are provisioned by a data or BI team outside the formal vulnerability-management process that covers “real” infrastructure — a governance gap this incident exposes directly.

For German Mittelstand companies, Metabase’s appeal as a free, self-hosted alternative to Tableau or Power BI makes it common in exactly the mid-market segment least likely to have dedicated application-security coverage for internal tools. Under NIS2 and GDPR, a breach through a connected analytics tool is treated the same as any other data breach — the notification clock starts the moment personal data is confirmed exposed, regardless of which system was the entry point.

What You Should Do Now

1. Upgrade immediately to the fixed release for your branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (Open Source), or the corresponding Enterprise/Pro build.
2. If you cannot patch immediately, block or disable the /api/session/reset_password endpoint at your reverse proxy or WAF as an interim measure.
3. Check whether you are affected: review Metabase admin account lists for any account you don’t recognize, and check application logs for unexpected POST traffic to the reset-password endpoint since August 3, 2026.
4. Rotate every credential Metabase held for connected databases, regardless of whether you find evidence of compromise — the credentials themselves were exposed the moment an attacker reached admin access, not only if data was confirmably exported.

DIESEC Perspective

This is a pattern we see regularly in Mittelstand environments: a self-hosted analytics or reporting tool gets deployed by whoever needed the dashboard fastest, gets wired into two or three production databases for convenience, and then never appears on anyone’s patch-management radar because “it’s just a reporting tool.” This Metabase CVSS 10 SQL injection zero-day case is a direct demonstration of why that framing is wrong — the tool’s privileges are the attack surface, not the tool’s function.

Not sure whether your internal BI or reporting tools have this kind of unmanaged database access? Contact DIESEC for a rapid third-party application inventory and credential-exposure review.

Sources: The Hacker News | BleepingComputer
Published: 2026-08-11 | Category: Vulnerabilities & Patches | ~4 min read