Metabase Zero-Day CVSS 10.0 Actively Exploited for Corporate Data Theft

Metabase confirmed on August 6, 2026 that a zero-day vulnerability, still without a CVE identifier, is being actively exploited against its cloud and self-hosted installations. The flaw, rated CVSS 10.0, allows an unauthenticated remote attacker to gain administrator privileges and from there extract sensitive data and credentials for connected databases. The first confirmations of impact come from three enterprise customers: Framework, Tally, and LexisNexis.

Verified Facts: The Attack Chain

The mechanism starts with an unauthenticated SQL injection in the /api/session/reset_password endpoint. According to the Metabase security advisory cited by BleepingComputer, this flaw allows a remote attacker to "inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance." The technical wording is precise: this is not a hypothetical complex escalation, but a direct path from anonymous user to maximum privileges.

From the administrator position, the attacker can modify application configuration, steal encrypted credentials for connected databases, read any data accessible through those connections, and exfiltrate it. Metabase has explicitly confirmed active exploitation of the vulnerability.

"This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance"

— Metabase Security Advisory, via BleepingComputer

Verified Facts: The CEO's Disclosure and IoCs

Sameer Al-Sakran, Metabase CEO, personally signed the notification. His statement, reported by BleepingComputer, is unequivocal: "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above." The explicit reference to "0-day" and the specification of affected versions remove ambiguity about the nature of the incident.

Al-Sakran provided concrete indicators of compromise. The sequence to look for in logs is precise: a POST request to /api/session/reset_password returning status 400, followed by a GET to /api/user/current with a 200 response. "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised," he stated.

Verified Facts: Who Suffered Impact

On August 6, 2026, Metabase notified Framework that its instance had been accessed on August 3. Framework subsequently confirmed theft of full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers, and company names. For business customers, exposure extends to VAT, EIN, and billing emails.

Tally confirmed compromise on the same date, August 3, with a different impact profile: emails and cryptographic password hashes. The notification explicitly states that attackers "did not reach your forms" and that the hash is "one-way, so it cannot be converted back to a password." However, the dossier does not specify the hashing algorithm used nor the presence of salt. BleepingComputer requested clarification from Tally without receiving a response by publication time.

LexisNexis confirmed impact on its Metabase API through a third-party vendor, with immediate disconnection of affected systems. The dossier does not establish whether LexisNexis suffered actual customer data exfiltration or only service disruption. The investigation is indicated as ongoing.

Analysis: The Risk Context

Metabase's structure as a business intelligence tool connecting to multiple databases amplifies the impact of compromise. A single administrative access exposes not only application data, but encrypted credentials for connected databases and data accessible through them. This concentration of access is intrinsic to the product architecture, not a specific misconfiguration.

The previous CVE-2023-38646 (CVSS 9.8, RCE), fixed three years prior, shows the product has already weathered a criticality of comparable severity. The recurrence of vulnerabilities of this magnitude over a three-year span is a documented fact, not an inference.

Immediate Actions

Metabase has released patches for all branches from version 0.58 through 0.63. Minimum safe versions are: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5. For instances that cannot be updated immediately, the temporary workaround is to block the /api/session/reset_password endpoint.

Metabase recommends revoking active sessions, rotating database credentials, and reviewing logs and query history. These actions are specific to the documented case and derive directly from the vendor advisory.

Documented Uncertainties

Uncertainties remain that the brief does not clarify. The hashing algorithm and presence of salt for exposed Tally passwords are unknown. The exact identity of the attacker is not identified. The total number of victims beyond Framework, Tally, and LexisNexis is not quantified. It is not established when or if a CVE will be assigned to the vulnerability. Metabase states the flaw does not affect versions prior to 0.58, but without publishing technical details demonstrating this. The presence of a public PoC or sale on underground markets is not documented.

Editorial Close

This article is based primarily on BleepingComputer's investigation, with convergent confirmations from The Hacker News and SecurityAffairs that do not add significant original elements. Information is current as of publication; source limitations are explicit in the preceding sections.

The Metabase case illustrates how compromise of a data interrogation layer can translate into exposure of critical business information. The distinction between managed cloud and self-hosted, in this incident, reduces to a distinction without substantive difference: both deployment modes were attacked via the same vector, and both require the same immediate actions.