2026 Metabase — critical SQLi zero-day (CVSS 10) exploited against Cloud; customer data theft
Data compromised
Varies by customer instance — connected warehouse data and stored DB credentials accessible after admin takeover. Named victims disclosing theft include Framework (customer PII) and Tally (emails + password hashes). LexisNexis reported Metabase API / Diligence / Newsdesk disruption from a related third-party vendor incident.
Technical writeup
Vendor-confirmed actively exploited critical vulnerability — Metabase CEO Sameer Al-Sakran disclosed on August 6, 2026 that Metabase Cloud was attacked using an unknown zero-day in versions 1.58 and above. Advisory GHSA-vwf4-m7j8-wcjf rates the unauthenticated SQLi critical (CVSS 10.0): arbitrary SQL against the application database can yield administrator access, configuration changes, theft of stored credentials for connected databases, and data export. Cloud instances were upgraded; self-hosted operators must patch to minimum safe releases (e.g. 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5) and revoke sessions, review API keys/admins, rotate connected DB credentials, and hunt for POST /api/session/reset_password (400) followed by GET /api/user/current (200). Framework and Tally publicly confirmed customer-data theft from compromised Metabase environments; LexisNexis disconnected third-party systems affecting Diligence, Metabase API and Newsdesk while investigating. Catalogued as the canonical vendor incident for the August 2026 Metabase exploitation wave.
Root cause
Unauthenticated SQL injection in Metabase ≥1.58 (/api/session/reset_password path) exploited as a zero-day against Metabase Cloud and vulnerable self-hosted instances, enabling remote admin access, credential theft for connected databases, and data export.