Metabase SQL Injection Zero-Day Exploited in Customer Data Theft Attacks

A critical Metabase SQL injection vulnerability has been exploited as a zero-day in active data-theft attacks targeting business intelligence installations across multiple organizations. Metabase confirmed that attackers exploited a previously unknown unauthenticated SQL injection flaw in software versions 1.58 and above (mapped to version branches 0.58 through 0.63). The flaw carries a maximum CVSS severity score of 10.0 and impacts both the Metabase Cloud SaaS platform and self-hosted deployments.

Metabase CEO Sameer Al-Sakran disclosed the incident following confirmation of active exploitation. While Metabase has patched its cloud platform and blocked the vulnerable API endpoints, organizations running self-hosted instances must immediately update their environments or apply network mitigations to prevent unauthorized access and database exfiltration.

Mechanics of the Metabase SQL Injection Vulnerability

SQL injection (SQLi) vulnerabilities occur when unvalidated user input is directly concatenated into SQL queries executed by the application database. In business intelligence platforms like Metabase, an unauthenticated SQL injection vulnerability is particularly dangerous because the application serves as a central connectivity hub for enterprise data warehouses and production database instances.

The vulnerability resides in the Metabase password reset endpoint, specifically accessible via POST /api/session/reset_password. Because the flaw allows unauthenticated remote code execution at the database layer, an attacker does not need valid credentials or an established session to launch an exploit. By sending specially crafted payloads to this endpoint, an attacker can execute arbitrary SQL commands against the primary Metabase application database.

Successful exploitation grants the attacker full administrator access to the Metabase application instance. From an administrative posture, an attacker can:

• Modify application settings and create backdoor administrative accounts.
• Exfiltrate stored authentication credentials and connection strings for all connected databases.
• Execute arbitrary SQL queries through Metabase’s database connectors to read, export, or modify data in connected external databases.
• Steal cached queries, session logs, and internal organizational analytics.

Because Metabase instances store access credentials for connected data sources—such as PostgreSQL, MySQL, Snowflake, or BigQuery environments—a compromise of the Metabase administrative layer exposes all underlying data stores connected to the platform.

Downstream Impact on Named Victims

Active zero-day exploitation has already led to confirmed data breaches across multiple enterprise organizations, with initial unauthorized access observed as early as August 3.

Framework

Laptop manufacturer Framework disclosed that an attacker compromised its Metabase environment on August 3 before Metabase alerted the company on August 6. The breach enabled attackers to exfiltrate sensitive customer personal data, including full names, email addresses, login IP addresses, phone numbers, and billing and shipping addresses. For business customers (Framework for Business), the exfiltrated records included corporate names, phone numbers, billing email addresses, Value Added Tax (VAT) IDs, and Employer Identification Numbers (EIN).

Tally

Online form builder Tally notified its users that its Metabase analytics environment was breached on August 3. The attacker accessed user email addresses and cryptographic password hashes stored within the analytics environment. Tally confirmed that form structures and submitted user responses were stored in isolated databases and were not compromised during the incident.

LexisNexis

LexisNexis issued customer notifications regarding service disruptions affecting its Diligence, Metabase API, and Newsdesk applications. The company identified unusual activity on infrastructure hosted by a third-party vendor and severed connections to contain the incident. LexisNexis engaged external digital forensics and incident response specialists to investigate whether customer data was accessed or exfiltrated during the disruption.

Detection and Indicators of Compromise

Security operations teams should inspect web application firewall (WAF), reverse proxy, and API gateway logs for exploitation attempts targeting the Metabase backend.

Metabase has released specific Indicators of Compromise (IoCs) to identify affected instances. Attack activity is characterized by:

1. A POST request sent to /api/session/reset_password that returns an HTTP 400 status code.
2. Followed immediately by a successful GET request to /api/user/current.

System logs containing this specific request pattern strongly indicate that the Metabase instance has been compromised by an attacker executing arbitrary SQL.

Mitigation and Remediation Actions

Metabase has released emergency security updates across all supported branches. The minimum safe releases containing fixes for this vulnerability are:

• 0.58.24
• 0.59.21
• 0.60.17
• 0.61.11
• 0.62.9
• 0.63.5

Required Incident Response Steps for Self-Hosted Customers

1. Apply Updates: Immediately upgrade self-hosted Metabase instances to one of the safe patched versions listed above.
2. Apply Emergency Workarounds: If an immediate software update cannot be deployed, block external access to the /api/session/reset_password endpoint at the WAF, load balancer, or reverse proxy layer.
3. Revoke Active Sessions: Terminate all active user sessions and revoke active API keys across the application.
4. Credential Rotation: Assume all connected data sources are compromised. Rotate access credentials, tokens, and password strings for every external database connected to Metabase.
5. Account and Log Auditing: Review all active administrative user accounts for unauthorized additions. Inspect application query execution logs for anomalous data exports or database enumeration activity.