Metabase has disclosed that a critical, unauthenticated SQL injection vulnerability in its analytics platform was exploited as a zero-day to compromise both its Metabase Cloud SaaS offering and self-hosted customer instances. The flaw affects versions 1.58 and above and has already led to confirmed data theft at multiple downstream organizations, including laptop maker Framework and form-builder Tally.
In a blog post, Metabase CEO Sameer Al-Sakran said the company identified an attack against Metabase Cloud using a previously unknown vulnerability. Metabase has blocked the endpoints used in the attack and shipped fixes, but has not assigned the flaw a CVE identifier. Its own security advisory rates the issue as Critical with a CVSS score of 10.0 and confirms active exploitation.
According to the advisory, the vulnerability allows a remote, unauthenticated attacker to inject arbitrary SQL into the Metabase application database, ultimately granting administrator access to the instance. From there, an attacker could alter application configuration, steal stored credentials for connected databases, read data through those connections, and exfiltrate it.
Patches and Detection
Metabase Cloud customers have already been upgraded automatically. Self-hosted customers must patch manually. Fixes are available across all affected branches from 0.58 through 0.63, with minimum safe versions listed as 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Organizations that cannot patch immediately are advised to temporarily block access to the /api/session/reset_password endpoint.
Metabase says compromise can be identified by a POST request to /api/session/reset_password returning a 400 status code, followed by a successful GET request to /api/user/current. Any logs showing this pattern indicate the instance was likely accessed by an attacker. The company recommends revoking active sessions, auditing API keys and admin accounts for unauthorized changes, rotating credentials for connected databases, and reviewing query history for signs of abuse.
Confirmed Victims
Framework confirmed attackers accessed its Metabase instance on August 3, after being notified by Metabase on August 6. Stolen data includes customer full names, email addresses, login IPs, billing and shipping addresses, phone numbers, and company names, with business customers also exposed to VAT, EIN, and billing email details.
Tally confirmed its Metabase analytics environment was breached the same day, exposing user email addresses and hashed passwords, though it says forms and submitted answers were stored separately and were not accessed.
LexisNexis also disclosed a related incident affecting its Diligence, Metabase API, and Newsdesk services after detecting unusual activity at a third-party vendor. The company disconnected the affected systems and is investigating with a forensic firm, though it has not confirmed whether customer data was exposed.