Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data Theft

Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data Theft 1. Basic Information Article Title : Metabase SQLi zero-day exploited in customer data-theft attacks Publisher : BleepingComputer Publication Date : August 7, 2026 Original Source : BleepingComputer Primary Sources : Metabase security update , GHSA-vwf4-m7j8-wcjf Related Entities : Metabase Cloud, Self-hosted Metabase, Framework, Tally, LexisNexis Vulnerability : Unassigned (as of August 7, 2026), GHSA-vwf4-m7j8-wcjf, CVSS 10.0, Unauthenticated SQL Injection Impact Scope : Affected unpatched versions of Metabase 0.58 to 0.63. Minimum safe versions are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 Severity : Critical Metabase has confirmed active exploitation. Framework and Tally reported unauthorized access and data leakage on August 3日起. Metabase Cloud is already patched, but self-hosted environments require manual updates. 2. Executive Summary This is an actively exploited attack where threat actors inject SQL without authentication into the public password reset API to gain Metabase administrator privileges. They then obtain and export connected database credentials and viewable data. 3. Attack Flow Chain A: Unauthenticated SQLi to Admin Privilege The attacker searches for Internet-facing Metabase instances. They send a crafted POST request to /api/session/reset_password . They inject arbitrary SQL into the Metabase application database. They gain administrator access. They send a GET request to /api/user/current to verify a valid administrator context. Chain B: Database Credential and Data Theft Using admin privileges, they list API keys, administrators, and connected DB settings. They retrieve connected database credentials stored in Metabase. Metabase queries and exports data within allowed limits. They modify settings or accounts as needed to maintain future access. Confirmed Real-World Impact Framework: Stole names, emails, login IPs, billing/shipping addre