Unauthenticated attackers exploit Metabase SQL injection vulnerability to steal customer data and credentials

Summary

A critical vulnerability in the Metabase business intelligence platform has been exploited in the wild, resulting in data theft at several organizations. The flaw is an unauthenticated SQL injection that grants remote attackers full administrative control over a Metabase instance.

Metabase confirmed that its Cloud SaaS platform was targeted via this zero-day vulnerability affecting versions 0.58 and above. While Metabase has already patched and upgraded its Cloud customers, those running self-hosted installations remain at high risk until they manually apply the security updates.

What happened

The exploitation of this vulnerability has already resulted in confirmed data theft across multiple platforms. Laptop manufacturer Framework reported that attackers accessed its Metabase instance on August 3, stealing customer information including full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers, and company names.

The online form builder Tally also notified users of a compromise to its Metabase analytics environment on August 3. According to Tally, the attackers accessed user email addresses and password cryptographic hashes, though the company stated that form data and answers were stored separately and not reached by the attack.

Additionally, LexisNexis reported a service disruption affecting its Diligence, Metabase API, and Newsdesk applications due to unusual activity on servers managed by a third-party vendor. The company disconnected these systems to contain the issue while investigating with a forensic firm.

Technical details

The vulnerability is an unauthenticated SQL injection flaw within the Metest application database. An attacker can inject arbitrary SQL commands to escalate privileges, gaining complete administrator access to the instance.

Once administrative control is established, an attacker can:

• Change application configurations.
• Steal stored credentials for all connected databases.
• Read any data accessible through those active connections.
• Export sensitive datasets from the environment.

The vulnerability affects Metabase versions 0.58 and above.

Affected products and fixed versions

Detection

Attackers are utilizing a specific request pattern to exploit the vulnerability. Security teams should monitor application and server ingress logs for the following sequence:

1. A POST request to /api/session/reset_password that returns a 400 status code.
2. A subsequent successful GET request to /api/user/current returning a 200 status code.

If these entries appear in your logs, the instance has likely been compromised.

Defender guidance

Immediate action is required for all self-hosted Metabase users.

1. Patching and Mitigation Upgrade your installation to the latest point release corresponding to your major version (see table above). If an immediate upgrade is not possible, block all access to the /api/session/reset_password endpoint as a temporary workaround.

2. Post-Exploitation Cleanup After upgrading, you must perform the following steps to ensure the attacker has been evicted:

• Revoke Sessions: Access the Metabase application database directly and delete all rows in the core_session table to terminate all active user sessions.
• Audit Accounts: Review all administrator accounts for unauthorized changes or new users.
• Inspect API Keys: Check all existing API keys and delete any that you do not recognize.
• Rotate Credentials: Change passwords and rotate credentials for every database connected to your Metabase instance.
• Review Logs: Inspect data warehouse logs and Metabase query history for signs of unauthorized data access or export activity.