A critical SQL injection zero-day vulnerability in Metabase
13 Aug 2026
On 3rd August, Metabase discovered that its Metabase Cloud environment has been attacked through active exploitation of zero-day vulnerability. August 6th onwards, Downstream customers, including Framework and Tally, began disclosing data breaches.
Through the blog, we will understand what the critical 0-day SQLi vulnerability is about, the threat It poses, and what organizations should do to defend against it.
About the vulnerability
|
Vendor + component affected |
CVEs |
About |
CVSS |
|
Metabase + Web/API Application |
Unassigned |
Unauthenticated SQL Injection (SQLi)
A critical vulnerability in Metabase that allows attackers to gain administrative access and execute SQL queries against the Metabase application database.
|
10 (Critical) |
Timeline
|
Date |
What happened |
|
August 3, 2026 |
Metabase discovered exploitation of its Cloud service |
|
August 3 to 6 |
Metabase blocked the attack path, investigated and developed fixes |
|
August 6 |
Metabase publicly disclosed the critical vulnerability |
|
August 6 onward |
Downstream customers, including Framework and Tally, began disclosing data breaches |
Threat posed by the vulnerability
This zero-day vulnerability is particularly dangerous because once inside Metabase with administrative access an attacker can:
- Use the credentials to connect to underlying databases
- Gain administrative access to Metabase.
- Access credentials for connected databases.
- Access and export sensitive data from connected databases.
- Modify Metabase configuration and export data.
Official mitigation guide
Metabase has advised customers to upgrade their Metabase instance ASAP and for those can’t upgrade ASAP, a temporary workaround is recommended:
- Block the – /api/session/reset_password endpoint.
If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible, then please do the following after you upgrade:
- Revoke all active user sessions by accessing the Metabase application database and deleting all rows in core_session table
- Review your API keys and delete any unrecognized keys.
- Review administrator accounts for any unexpected changes.
- Rotate credentials for any of the connected databases.
- Review data warehouse logs for any sign of unauthorized access.
- Review Metabase activity and query history for unexpected or unauthorized activity.
Upgrade affected self-hosted Metabase deployments to the following patched versions:
- 0.58.24
- 0.59.21
- 0.60.17
- 0.61.11
- 0.62.9
- 0.63.5
SharkStriker’s recommendations
- Identify and verify all Metabase instances and versions.
- Upgrade vulnerable instances immediately.
- Review Metabase/API logs for exploitation attempts.
- Investigate suspicious administrator or API-key changes.
- Rotate connected database credentials if exploitation is suspected.
SharkStriker’s Actions
- Recommended immediate version validation and patching.
- Recommended monitoring Metabase API activity for exploitation attempts.
