The critical zero-day can provide direct SQL access to Metabase’s underlying database, potentially exposing credentials, API keys, and other sensitive data.
Business intelligence (BI) platform provider Metabase has disclosed a zero-day SQL Injection vulnerability, warning that customers’ sensitive credentials, tokens, API keys, and other data may have been exposed.
The Metabase vulnerability revealed on August 6, designated CVE-2026-72898, is identified as critical, with a severity score of 10, the highest possible rating. It is present in versions 1.58 and up.
“You don’t see a perfect 10/10 on CVSS often, but when you do, be worried,” noted David Shipley, CEO of Beauceron Security. SQL injection is “old school and painful, as there’s now working proof of concept exploit code.”
‘Unmitigated, raw’ database access
Metabase is an open-source BI tool that customers can connect to popular databases, including Databricks, MongoDB, Oracle, Snowflake, Amazon, BigQuery, and many others. They can use the platform to access analytics, query and visualize data, and build dashboards, among other actions.
Search engine Shodan has tracked roughly 2,500 Metabase instances, and security company Wiz reported that around 13% of cloud environments have deployed self-hosted Metabase instances; of those, about 25% are fully accessible on the internet.
According to Metabase’s disclosure, a threat actor used a zero-day SQL injection vulnerability in the company’s platform to gain access. The entry point is /api/session/reset_password.
Metabase said that after it discovered the attack, it immediately blocked the exploited endpoints, patched the vulnerability, terminated relevant sessions, and revoked credentials used in the incident. Metabase Cloud customers have already been upgraded and patched against the vulnerability, but self-hosted Metabase customers may still be vulnerable unless they have patched.
“This vulnerability allows attackers to have unmitigated, raw SQL access to the Metabase database,” said Scott Miserendino, CTO at DataBee. They can steal or alter account credentials for connected databases, create new administrator accounts, change app configurations, escalate privileges, or even “degrade, alter or destroy” information.
He emphasized that this vulnerability can also affect platforms that use original equipment manufacturer (OEM) versions of Metabase as part of their infrastructure. This means affected users may not even know they are affected, because they are not aware that Metabase is part of the product they purchased.
“It is a very serious vulnerability,” Miserendino cautioned.
Victims so far
Companies that have been impacted by the breach seem, at least to so far, to be smaller organizations and startups. They include Kilo Code, which was recently acquired by Anaconda; Y Combinator backed Tally, which is building autonomous accounting agents; personal computer manufacturer Framework; workflow automation platform n8n; and AI testing and monitoring platform provider ChecklyHQ.
The impacted companies report that threat actors accessed records containing usernames, email addresses, cloud passwords, cryptographic hashes of OpenTelemetry (OTel) API keys used for trace collection, Slack access tokens, and other sensitive information.
They all report that they are directly contacting impacted customers and have taken mitigation actions, including rotating potentially impacted credentials and API keys, resetting all user passwords, invalidating all Slackbot authentication tokens for impacted users, removing compromised admin accounts, and reviewing internal audit logs.
“The vulnerability was in a vendor’s product, but protecting your data is our job, and this incident put some of it at risk,” Checkly said in its notice.
It said it is rethinking internal processes around analytics tools, improving sanitation when storing check configurations and data, and performing extensive audits to limit exposure. Its on-call engineers will also be paged when future vendor security notices are released to allow for faster response.
“Rotating credentials fixes the immediate problem,” the company noted. “It does not fix the reason this hurt: Our analytics environment held more sensitive data and had broader access than it needed.”
What affected customers should do
The attack pattern, according to Metabase, is:
- A call to POST /api/session/reset_password with a 400 status code
- This is followed by a call to GET /api/user/current with a 200 status code
“If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised,” the company said.
Customers should upgrade to an appropriate patch as soon as possible. For instance, if running Metabase 0.58.6, move to 0.58.24 or later. Those unable to immediately upgrade can implement a temporary workaround by blocking the /api/session/reset_password endpoint.
If the /api/session/reset_password endpoint of a Metabase instance is publicly accessible, enterprises should revoke all active user sessions; review and delete any unrecognized API keys; audit data warehouse logs and admin accounts for unauthorized access or other unexpected changes; rotate credentials for all connected databases; and review Metabase activity and query histories.
If wrapping a third-party’s REST interface, enterprises should always perform their own SQLi detection, DataBee’s Miserendino advised. This can be done by incorporating a web access firewall (WAF) or reverse proxy.
“Enterprises should also monitor their security and database logs for the creation of new or recently elevated administrator accounts,” he said, “or other unusual activity such as large volumes of data drops.”
Anaconda, for its part, urges customers to remain diligent: “Be on alert for phishing/social engineering, and maintain credential hygiene (including auditing, reviewing, and rotating credentials regularly) and spam monitoring.”