Executive Summary
A critical zero-day vulnerability in Metabase, a widely adopted open-source business intelligence and data visualization platform, has been exploited in the wild, enabling unauthenticated attackers to gain administrator access. This flaw, which impacts both Metabase Cloud and self-hosted deployments, allows remote adversaries to inject arbitrary SQL into the application database via a vulnerable API endpoint. Successful exploitation results in full administrative control, exposure of sensitive data, theft of credentials for connected databases, and the potential for lateral movement within affected environments. The vulnerability is being actively targeted, with at least one confirmed breach involving customer personally identifiable information (PII). Immediate action is required to mitigate risk and prevent further compromise.
Threat Actor Profile
Attribution for the exploitation of this Metabase zero-day remains undetermined as of this report. The observed tactics, techniques, and procedures (TTPs) align with those of financially motivated cybercriminals and data theft actors rather than advanced persistent threat (APT) groups or nation-state adversaries. The attack methodology is opportunistic, targeting publicly exposed Metabase instances across sectors. The lack of sophisticated obfuscation or custom malware suggests the threat actors are leveraging publicly available reconnaissance tools and automated scripts to identify and exploit vulnerable deployments. The rapid weaponization and exploitation of this vulnerability indicate a high level of attacker agility and a focus on mass data exfiltration for financial gain or resale on underground forums.
Technical Analysis of Malware/TTPs
The vulnerability in Metabase is an unauthenticated SQL injection flaw present in the /api/session/reset_password endpoint. Attackers exploit this by sending a specially crafted POST request to the endpoint, which triggers the injection and allows arbitrary SQL execution within the application database context. Upon successful exploitation, the attacker can escalate privileges to administrator by manipulating user records or session tokens directly in the database. This grants access to the full administrative interface, enabling the attacker to alter application configurations, enumerate and export sensitive datasets, and retrieve credentials for all connected data sources.
The typical attack sequence involves an initial POST request to /api/session/reset_password, which returns an HTTP 400 status code, followed by a GET request to /api/user/current, which returns HTTP 200, confirming successful privilege escalation. The attacker may then enumerate users, export dashboards, and extract database connection strings and secrets. No malware deployment has been observed; the attack is purely application-layer and leverages legitimate Metabase functionality post-compromise.
The vulnerability affects the following Metabase versions: 0.58.0 through 0.58.23 (fixed in 0.58.24), 0.59.0 through 0.59.20 (fixed in 0.59.21), 0.60.0 through 0.60.16 (fixed in 0.60.17), 0.61.0 through 0.61.10 (fixed in 0.61.11), 0.62.0 through 0.62.8 (fixed in 0.62.9), and 0.63.0 through 0.63.4 (fixed in 0.63.5). Instances running versions below 0.58 are not affected.
The attack chain maps to several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) for initial access, T1078 (Valid Accounts) for persistence if credentials are stolen, T1552 (Unsecured Credentials) for credential access, T1005 (Data from Local System) for collection, and T1041 (Exfiltration Over C2 Channel) for data exfiltration.
Exploitation in the Wild
Active exploitation of this Metabase zero-day has been confirmed. The most prominent publicized incident involves Framework, a PC manufacturer, whose Metabase Cloud instance was compromised. Attackers accessed customer names, login IPs, addresses, phone numbers, and email addresses. No payment or order data was reported as accessed. The attack pattern observed in the wild matches the technical analysis: a POST to /api/session/reset_password followed by a GET to /api/user/current. These requests, when observed in server logs, are strong indicators of compromise.
Security researchers and incident responders have reported similar attack sequences targeting other organizations, suggesting widespread scanning and exploitation. The vulnerability is being discussed in cybersecurity forums, and proof-of-concept exploit details are circulating among threat actors, increasing the likelihood of further attacks.
Victimology and Targeting
The primary confirmed victim is Framework, but the attack surface includes any organization running vulnerable versions of Metabase, whether self-hosted or cloud-based. Sectors at risk include technology, manufacturing, finance, healthcare, education, and any enterprise leveraging Metabase for business intelligence. The global nature of Metabase deployments means organizations in all geographic regions are potential targets. The attackers appear to be indiscriminate, focusing on mass exploitation rather than sector-specific targeting. However, the impact is particularly severe for organizations storing sensitive customer or business data within Metabase or connected data sources.
Mitigation and Countermeasures
Immediate mitigation requires upgrading Metabase to the latest fixed version corresponding to your deployment branch. If immediate patching is not feasible, organizations should restrict external access to the /api/session/reset_password endpoint at the network or application layer. All active user sessions should be revoked by deleting entries in the core_session table of the Metabase application database. It is critical to review and rotate all credentials and API keys for connected databases, as these may have been exfiltrated. Administrator accounts should be audited for unauthorized changes, and all relevant logs should be reviewed for evidence of unauthorized access or data export.
If indicators of compromise are present, organizations must assume full compromise of the Metabase environment and connected data sources. Incident response procedures should include forensic analysis, credential rotation, and notification of affected stakeholders. Organizations are advised to monitor for further advisories from Metabase and the broader security community, as additional attack vectors or exploit variants may emerge.
References
https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html?m=1 https://securityaffairs.com/196874/hacking/metabase-zero-day-exploited-in-the-wild-exposing-admin-access-and-sensitive-data.html?amp https://www.engadget.com/framework-data-breach-metabase-zero-day-2026.html https://www.reddit.com/r/SecOpsDaily/comments/1viq5ga/metabase_zeroday_exploited_in_wild_allows_admin/ https://www.linkedin.com/posts/cybercureme_metabase-zero-day-exploited-in-wild-allows-activity-7491763497114996737-ZP2u https://www.metabase.com/blog/security-update
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information or to discuss how Rescana can help secure your organization, we are happy to answer questions at info@rescana.com.
