Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data Theft

Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data Theft 1. Basic Information Article Title: Metabase SQLi zero-day exploited in customer data-theft attacks Publisher: BleepingComputer Publication Date: August 7, 2026 Original Source: BleepingComputer Primary Sources: Metabase security update, GHSA-vwf4-m7j8-wcjf Related Entities: Metabase Cloud, Self-hosted Metabase, Framework, Tally, LexisNexis Vulnerability: Unassigned (as of August 7, 2026), GHSA-vwf4-m7j8-wcjf, CVSS 10.0, Unauthenticated SQL Injection Impact Scope: Affected unpatched versions of Metabase 0.58 to 0.63. Minimum safe versions are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 Severity: Critical Metabase has confirmed active exploitation. Framework and Tally reported unauthorized access and data leakage on August 3日起. Metabase Cloud is already patched, but self-hosted environments require manual updates. 2. Executive Summary This is an actively exploited attack where threat actors inject SQL without authentication into the public password reset API to gain Metabase administrator privileges. They then obtain and export connected database credentials and viewable data. 3. Attack Flow Chain A: Unauthenticated SQLi to Admin Privilege The attacker searches for Internet-facing Metabase instances. They send a crafted POST request to /api/session/reset_password. They inject arbitrary SQL into the Metabase application database. They gain administrator access. They send a GET request to /api/user/current to verify a valid administrator context. Chain B: Database Credential and Data Theft Using admin privileges, they list API keys, administrators, and connected DB settings. They retrieve connected database credentials stored in Metabase. Metabase queries and exports data within allowed limits. They modify settings or accounts as needed to maintain future access. Confirmed Real-World Impact Framework: Stole names, emails, login IPs, billing/shipping addresses, phone numbers, and company names. Tally: Accessed email addresses and password hashes. Tally stated that forms and responses are on a separate system and were not reached. LexisNexis: Disconnected third-party systems, including the Metabase API. It remains unconfirmed if data was leaked. 4. Attacker Position and Execution Location Attacker: Reaches the Metabase HTTP API from the Internet. Initial Execution Location: Metabase application server and application database. After Privilege Gain: Metabase administrator context. Subsequent Access Target: Data warehouses and business databases registered in Metabase. User Devices: No user action or code execution on user devices is required. 5. Visibility for Victims and Administrators To users, the service looks like a normal analysis screen, and no action is required during the breach. For administrators, the attack looks like an HTTP 400 POST request to the password reset API that appears to fail, immediately followed by a successful HTTP 200 on /api/user/current. Other indicators include unknown administrators or API keys, unusual queries or exports, and abnormal use of connected databases. 6. Success and Failure Conditions Success Conditions Running vulnerable versions 0.58 to 0.63. /api/session/reset_password is reachable from the attacker's source. WAF or reverse proxy does not block the crafted POST request. Metabase stores connected database credentials with high privileges. Inability to detect or block queries, exports, or outbound data transfers. Failure Conditions Updated to a safe version. Temporarily blocking the target endpoint. Restricting source IPs that can reach Metabase. Using least-privilege principles and read-only limits for connected database credentials. Detecting the attack pattern and immediately revoking sessions and API keys. 7. What Happens on Success Metabase administrator privileges, settings, API keys, and connected database credentials are compromised. Threat actors can query and export customer and business data viewable from Metabase. If they directly abuse the connection credentials, they can also access databases from outside Metabase. 8. Observable Logs Email No user action is required, so no initial compromise email is generated. Check for notifications about newly added administrators or API keys after the breach. Proxy / SWG / DNS POST /api/session/reset_password from an external IP. Immediate GET /api/user/current from the same source/session. Large data transfers from the Metabase host to an unknown external destination (Inference). Endpoint / EDR Abnormal SQL sent to the application database by the Metabase process. Application logs, web access logs, and container logs. Settings changes, session table operations, and creation of unknown administrators. OS command execution has not been confirmed in public reports. Identity / IdP Issuance and use of new administrator sessions. Suspicious API keys that remain even after all sessions are revoked. Management operations from unusual IPs, times, or User-Agents. SaaS / Cloud Metabase Cloud audits, self-hosted activity/query history. Query and export audits on connected data warehouses. Read and rotation history if connection credentials are managed in a secret manager. Network Chronological sequence of POST 400 -> GET 200. Unusually broad and large queries from Metabase to the connected database. Increase in large responses and outbound data transfers from the DB to Metabase. 9. Attack Success Determination Contact Only: Scanning or POST requests to the target endpoint with no follow-up. User Action: Not required. Initial Execution: SQLi request reaches the application database. Authentication/Admin Success: GET /api/user/current (200) by the same entity immediately after POST 400, or discovery of a suspicious admin session. Data Theft/Session Compromise: Retrieval of connection credentials, abnormal queries/exports, and outbound transfers confirmed. Follow-up Compromise Confirmed: Direct DB login using stolen credentials, unknown API keys/admins, and setting changes confirmed. Metabase states that if the logs contain the combination of POST 400 and GET 200 mentioned above, a compromise is very likely. 10. Investigation Playbook Trigger Vulnerable version in use and endpoint is public. POST /api/session/reset_password (400) -> GET /api/user/current (200). Unknown administrators, API keys, or large exports. Initial Check Confirm the version, exposure scope, and patch application time. Preserve ingress, access, application DB, activity, and query history. Extract the initial timestamp, source IP, User-Agent, and session of the endpoint access. Retrieve changes to administrators, API keys, and settings around the attack time. Endpoints and Servers Metabase process/container and application DB query history. Check for new files/processes, web shells, or OS commands. Synchronize timestamps for reverse proxy/WAF/CDN logs and Metabase logs. Authentication and Cloud Invalidate sessions by deleting all rows in core_session. Delete unknown API keys and administrators. Rotate connected database credentials. Check Metabase permissions and usage history in DB/cloud IAM. Follow-up Actions Investigate all connected databases for abnormal queries, table scans, and exports. Check for reads of customer data similar to Framework/Tally incidents. Look for direct logins from outside Metabase using stolen credentials. Containment Update to a safe version, or immediately block the endpoint if updating is delayed. Restrict sources that can reach Metabase. Revoke and rotate sessions, API keys, admin credentials, and database connection credentials. Consider rebuilding compromised self-hosted instances. Determination Categories Scanning Only Exploit Attempted SQL Injection Succeeded Metabase Admin Compromised Connected Database Accessed Data Exfiltration Confirmed Follow-on Database Compromise Confirmed 11. Defense and Detection Ideas Single Event External POST /api/session/reset_password. Creation of unknown administrators or API keys. High-volume or high-capacity exports by Metabase. Time-Series Correlation POST reset_password (400) -> GET user/current (200) -> Admin/API key modification -> Large queries to connected DB -> Export/egress. Threat Hunting Perspectives Review all operations with the same pattern back to when the endpoint was first made public. Review all operations from the same source IP/User-Agent/session. Check for deviations from normal query baselines for each connected DB. New connection sources using Metabase credentials. Log Gaps HTTP request path, status, and source. Metabase activity and query history. Application DB query audits. Connected DB authentication, query, and export audits. Egress flow and byte counts. Priority Countermeasures Update immediately to a safe version. Block endpoints and restrict management access sources. Revoke and rotate all sessions, API keys, and connected DB credentials. Detect correlations between known patterns and large database queries. Apply the principle of least privilege to Metabase connection users. 12. Facts / Inference / Hypothesis Facts Unauthenticated SQLi allows attackers to gain Metabase administrator access. Active exploitation is confirmed, and the CVSS score is 10.0. The attack pattern shows user/current (200) immediately following reset_password (400). Framework and Tally reported access and data leakage on August 3. CVE was unassigned as of August 7, 2026. Inference The broader the permissions of the connected database, the greater the impact on business databases beyond just the Metabase compromise. Correlating DB query volumes with characteristic HTTP patterns improves the accuracy of data theft detection. Hypothesis If attackers reuse stolen connection credentials outside of Metabase, web logs alone may miss subsequent compromises. 13. MITRE ATT&CK Mapping High Confidence T1190 Exploit Public-Facing Application T1213 Data from Information Repositories T1530 Data from Cloud Storage Object (If Metabase Cloud/connected to cloud data stores) Medium Confidence T1078 Valid Accounts: If use of stolen admin sessions/connection credentials is confirmed. T1098 Account Manipulation: If creation of unknown admins/API keys is confirmed. T1552 Unsecured Credentials: Method for retrieving stored connection credentials is unpublicized. T1567 Exfiltration Over Web Service: The route used to exfiltrate data after export is unpublicized. 14. Unknowns and Additional Investigations CVE number and root cause details. Active exploitation start date and attacker infrastructure. Number of victim organizations other than Framework and Tally. Actual scope of usage for stolen database connection credentials. Tally's password hashing method and use of salt. Confirmation of data leakage at LexisNexis. 15. Impact on SOCs and Organizations Metabase is often deployed by departments or run in small-scale Docker environments, making it easy for public instances to remain unknown to central IT. Security operations teams should go beyond basic vulnerability management by using asset discovery to check if Metabase and its target endpoints are publicly exposed. If indicators of compromise are found, the investigation scope must extend to connected databases. When customer and employee data are consolidated into analytics platforms, organizations must also handle potential personal data breach response in parallel. 16. Summary For SOCs Prioritize searching for POST 400 -> GET 200 patterns. Correlate Metabase logs with connected database queries and exports. Distinguish between contact, admin success, database reads, and data exfiltration. For Administrators Update to a safe version, and rotate all sessions, API keys, and connected database credentials. Do not expose management interfaces and target endpoints directly to the Internet. Limit connected database users to minimum required read permissions. For Users This is a server-side attack that does not require user action. If administrators notify you of credential changes or breaches, follow instructions promptly and change passwords if you reuse them on other services.