Critical Metabase SQL Injection Exposed in Zero-Day Cybersecurity Data Breaches
A critical zero-day SQL injection vulnerability in Metabase was actively exploited in the wild, enabling attackers to breach customer instances and steal sensitive data from organizations including Framework, Tally, and LexisNexis. The flaw, rated CVSS 10.0, affected versions 0.58 through 0.63 and has since been patched — but not before damage was done.
Metabase disclosed the attacks on August 7, 2026, warning that its Metabase Cloud SaaS platform was compromised through a previously unknown vulnerability affecting versions 1.58 and above. The company also confirmed that self-hosted installations were equally at risk.
"We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above," Metabase CEO Sameer Al-Sakran wrote in a blog post. "The vulnerability is an unauthenticated SQL injection flaw in Metabase that can ultimately give a remote attacker administrator access to a customer's instance."
While no CVE identifier has been assigned, the severity speaks for itself. A CVSS score of 10.0 means this is as critical as it gets.
How the Attack Actually Worked
Here's where it gets interesting — and frankly, a bit terrifying. The SQL injection flaw allowed an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, ultimately gaining administrator access to the compromised instance. Once inside, the attacker could change application configuration, steal stored credentials for connected databases, read any data accessible through those connections, and export data.
Metabase has confirmed active exploitation of this vulnerability, and the attack signature is actually quite specific. Security teams can look for a POST request to /api/session/reset_password returning a 400 status code, followed by a successful GET request to /api/user/current.
According to Metabase, system logs showing these entries have likely been compromised. That's not exactly comforting.
The vulnerability exists in Metabase versions 0.58 through 0.63. Organizations running vulnerable self-hosted installations had to update manually — and many clearly didn't move fast enough.
The Victims: Framework, Tally, and LexisNexis
The fallout from this zero-day has been significant. Several major organizations have confirmed breaches linked to the Metabase vulnerability.
Framework, the laptop maker, confirmed that customer information was stolen after attackers compromised its Metabase instance. In a breach notification shared with BleepingComputer, Framework said the incident exposed customer full names, email addresses, login IP addresses, billing and shipping address information, phone numbers, and company names. For Framework for Business customers, the data may also include company name, phone number, VAT, EIN, and billing email address.
Framework said Metabase notified the company on August 6 that its instance had been vulnerable to the zero-day and accessed by the attacker on August 3.
Tally, the popular online form builder, notified users that its Metabase analytics environment was compromised on August 3. "Through that they reached your email address, and your password as a cryptographic hash," Tally explained. "A hash is one-way, so it can't be turned back into your password. They didn't reach your forms, or the answers people submitted to them. Those are stored separately."
BleepingComputer asked Tally which password hashing algorithm was used and whether the exposed password hashes were salted, but had not received a response at the time of publication.
LexisNexis also confirmed impact, warning customers about a cyberattack at one of its third-party vendors. While the company did not specifically state it was linked to the Metabase API by name, it did confirm its Metabase API was impacted by the attack. "We are writing to provide an update on the service disruption affecting Diligence, Metabase API and Newsdesk," LexisNexis said in an email. "Earlier this week, we identified unusual activity on servers that are hosted and managed by a third-party vendor. To protect our customers and contain the issue at its source, we made the immediate decision to disconnect from those third-party systems."
LexisNexis said taking the systems offline caused affected applications to become unavailable, but the company insisted it was necessary while it investigated. It's unclear whether customer data was exposed during the attack, but LexisNexis is working with a cybersecurity forensic firm to investigate the incident.
What Security Teams Should Do Now
Metabase has released patched versions for all affected branches from 0.58 through 0.63. The minimum safe releases are:
- 0.58.24
- 0.59.21
- 0.60.17
- 0.61.11
- 0.62.9
- 0.63.5
Organizations unable to upgrade immediately are advised to temporarily block access to the /api/session/reset_password endpoint until the update can be applied.
Metabase also recommends that self-hosted customers take several additional steps:
- Immediately upgrade to a safe version
- Revoke all active user sessions
- Review API keys and administrator accounts for unauthorized changes
- Rotate credentials for connected databases
- Inspect logs and query history for signs of compromise
The company's guidance is clear, and it's about as actionable as incident response recommendations get. The question is whether organizations acted on it in time.
Patch Versions and Mitigation Steps
The good news: the vulnerability is patched. The bad news: it was exploited for days — possibly longer — before the fix was available.
For organizations still running vulnerable versions, the temporary mitigation is straightforward. Block access to the /api/session/reset_password endpoint. It's not a permanent fix, but it's better than nothing while you work on upgrading.
The attack pattern is distinctive enough that security teams should be able to identify potentially compromised systems by searching their logs for the specific POST-to-400-then-GET pattern described above. If you see it, assume compromise and act accordingly.
This is another reminder that zero-day vulnerabilities affecting widely deployed software can have serious consequences — especially when organizations delay patching or fail to monitor for attack signatures. Metabase's situation won't be the last of its kind.
Source: Metabase SQLi zero-day exploited in customer data-theft attacks by Mayank Parmar, BleepingComputer, August 7, 2026
