Metabase Zero-Day: Unauthenticated SQL Injection (CVSS 10.0) Exploited to Breach Framework and Tally

Metabase disclosed on August 6 that a previously unknown, unauthenticated SQL injection flaw in its BI platform was exploited in the wild to compromise customer instances on Metabase Cloud, including hardware maker Framework and payments company Tally. The vulnerability, tracked as GHSA-vwf4-m7j8-wcjf (no CVE has been assigned yet), carries a CVSS score of 10.0 — full compromise, no authentication, no user interaction.

What happened

Metabase says it discovered the attack on August 3, 2026, and traced the intrusion to an unauthenticated SQL injection vulnerability in the /api/session/reset_password endpoint. By crafting malicious input to that endpoint, an attacker with no credentials at all can inject arbitrary SQL into the Metabase application database — enough to forge a valid session and land with administrator access on the target instance.

From admin access, the attack chain is straightforward: administrators in Metabase can view and edit configured database connections, including stored credentials for every data source the instance is wired into. That gives an attacker a path from a single web-app bug to full read access on whatever data warehouses, production databases, or analytics stores the victim connected to Metabase — plus the ability to export dashboards and query results directly.

The observed exploitation pattern documented in the advisory is a POST to /api/session/reset_password that returns HTTP 400, immediately followed by a GET to /api/user/current that returns HTTP 200 — the tell that the injection succeeded in minting a valid session despite the outward-facing error.

Metabase’s Cloud-hosted customers were patched by the vendor directly. But two of those customers — Framework and Tally — had already been breached before the fix landed. Metabase notified Framework on August 6 that its instance had been accessed; Framework in turn notified “all customers” roughly six hours later, disclosing that names, email addresses, phone numbers, and physical addresses were exposed. Payment data was not affected in Framework’s case. Tally’s disclosure covers a separate but related compromise via the same flaw.

Affected versions

The bug spans every actively maintained Metabase branch from 0.58 through 0.63:

Versions below the 58 branch are not affected. Self-hosted deployments — which do not benefit from Metabase’s own Cloud patching — remain exposed until operators upgrade manually.

Impact

This is a textbook case of a BI/analytics tool becoming the softest point of entry into an organization’s actual data. Metabase instances are routinely wired directly into production databases, data warehouses, and customer-record systems because that’s the entire point of the product. An unauthenticated attacker who can reach an internet-facing Metabase instance goes, in two requests, from zero access to holding the credentials for every database it’s connected to. Given the CVSS 10.0 rating and confirmed in-the-wild exploitation prior to disclosure, treat any internet-reachable Metabase instance on an affected branch as compromised until proven otherwise.

Mitigation

• Upgrade immediately to the minimum safe release for your branch (58.24, 59.21, 60.17, 61.11, 62.9, or 63.5).
• If you cannot patch right away, block access to /api/session/reset_password at the reverse proxy or WAF as a stopgap — this closes the specific injection path without requiring an app restart.
• Assume compromise on any vulnerable instance that was internet-facing before August 6 and work through Metabase’s post-incident checklist:
  • Invalidate all active sessions by clearing the core_session table.
  • Audit API keys for entries you don’t recognize.
  • Review admin accounts for unauthorized additions or privilege changes.
  • Rotate credentials for every database connection configured in the instance.
  • Check downstream data-warehouse access logs for anomalous queries originating from Metabase’s service account.
  • Review Metabase’s own activity/query logs for suspicious activity around the reset-password endpoint.

Advisory: GHSA-vwf4-m7j8-wcjf. Vendor statement: metabase.com/blog/security-update.