Metabase SQL Injection Under Active Exploitation

On August 6, 2026, Metabase published GHSA-vwf4-m7j8-wcjf and instructed customers to upgrade as soon as possible. The advisory assigns CVSS 10.0 and describes a network-reachable, low-complexity, unauthenticated path with no user interaction.¹

The vulnerable reset-password endpoint can be used to inject arbitrary SQL into the application database. That database holds Metabase operational state and security-relevant configuration; vendor-stated consequences begin with administrator access and can extend to connected databases through credentials and permissions entrusted to Metabase.^{1, 3}

This is not closed by installing a patch alone when the endpoint was publicly reachable. The vendor specifically calls for session revocation, API-key and administrator review, connected-database credential rotation, and inspection of warehouse logs plus Metabase activity and query history after upgrade.^{1, 2, 4}

The vendor gives defenders an unusually specific likely-compromise test: correlate a POST to /api/session/reset_password returning HTTP 400 with a subsequent GET to /api/user/current returning HTTP 200. Finding the ordered pair in application or ingress logs should move the case from exposure management into incident response.¹¹

Attributed notifications from Framework and Tally describe theft of customer or user data after August 3 Metabase compromises. LexisNexis described disruption involving third-party-hosted systems but had not confirmed data exposure at the reporting cutoff. These cases prove real impact while requiring organization-specific boundaries.¹²

The public record confirms exploitation in the wild but does not establish compromise of any particular organization. No public attacker infrastructure, malware artifact, payload, actor name, victim list, or exploitation start date is supplied by the controlling source.¹

Metabase's August 6 disclosures establish both a critical vulnerability and an actual incident. The company says Metabase Cloud was attacked through a previously unknown flaw affecting versions 1.58 and above, blocked the abused endpoints, patched Cloud, and published emergency guidance for self-hosted customers. The associated GHSA rates the unauthenticated SQL injection CVSS 10.0 and confirms active exploitation.^{1, 11}

The vulnerable surface is POST /api/session/reset_password. An unauthenticated remote attacker can inject arbitrary SQL into the Metabase application database and obtain administrator-level control. That is a trust-boundary failure: the attacker begins at a public API and may end with control of the BI application and access to secrets that connect it to higher-value databases.^{1, 11}

Metabase published a concrete detection sequence that materially changes triage quality: a POST to /api/session/reset_password returning HTTP 400 followed by a GET to /api/user/current returning HTTP 200. The vendor says finding this pattern in Metabase application or server-ingress logs means the instance is likely compromised. Defenders should preserve timestamps, request identifiers, source addresses, headers, response sizes, and surrounding requests before remediation destroys context.¹¹

The risk is larger than a dashboard outage. Administrator control may enable configuration changes, while the application's trusted connections may expose credentials and data in downstream databases. The advisory identifies credential theft, reading data reachable through those connections, and data export as potential consequences; each requires local validation before it is reported as an observed impact.^{1, 3}

Metabase names fixed versions x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5. The GHSA's machine-readable affected ranges contain visible gaps immediately below several named fixes. Because the vendor does not call those intervening builds safe, IntelliOS uses the named fixed release—or a later supported release—as the operational threshold.^{1, 2}

The temporary workaround is to block /api/session/reset_password. Durable remediation is an upgrade. For publicly accessible instances, the vendor then directs customers to revoke all sessions by deleting core_session rows, review and remove unexpected API keys, review administrator accounts, rotate connected-database credentials, and inspect both data-warehouse and Metabase histories.^{1, 2, 3, 4}

The public impact record is no longer empty. BleepingComputer reports that Framework notified customers that attackers accessed its Metabase instance on August 3 and stole names, email addresses, login IPs, billing and shipping addresses, phone numbers, company information, and—in some business records—VAT, EIN, and billing email data. Tally reportedly disclosed that its Metabase analytics environment was compromised on August 3 and exposed email addresses and cryptographic password hashes, while stating that form content and submissions were stored separately and were not reached.¹²

BleepingComputer also reports that LexisNexis disconnected third-party-hosted systems after unusual activity disrupted Diligence, Metabase API, and Newsdesk. LexisNexis had not confirmed customer-data exposure at the reporting cutoff. This row matters to SMBs and insurers because it demonstrates the third-party and service-availability dimension without overstating a verified Metabase data breach at LexisNexis.¹²

For U.S. SMB and MSP portfolios, priority should be driven by four multipliers: internet reachability, affected version, privilege of Metabase-held database identities, and sensitivity of connected data. An internal-only instance with tightly scoped read-only credentials is not equivalent to a public instance connected to customer, billing, identity, claims, or operational datasets with broad service-account permissions.^{1, 11, 12}

No CVE is assigned as of this update, so the issue cannot appear as a normal CVE-indexed KEV entry even though exploitation is vendor-confirmed. No authoritative source retained here names an actor, campaign, attacker IP, domain, file, hash, malware family, or total victim count. The older CVE-2023-38646 is a separate 2023 Metabase setup-token/H2 connection-string vulnerability and must not be conflated with this event.^{1, 5, 6, 11}