Metabase data leak from zero-day hack

Published August 8, 2026

Metabase, a data-dashboard tool many companies use behind the scenes, had a critical bug that let an outsider log in as administrator without a password. Attackers used it to steal customer data from companies including laptop maker Framework and form builder Tally.

Severity
Not scoredNo CVSS score recorded
Fix
Not confirmed
Affects
Metabase+2 more
Exploited
Not confirmedNo confirmation recorded

How it works

An attacker sends a specially crafted request to Metabase's password reset feature without logging in, and that request tricks the database into running the attacker's own commands, handing over administrator access to the whole instance.

What to do

Check your Metabase version in Admin Settings About, and compare it against the fixed builds for your branch. Metabase Cloud instances were already patched by Metabase on August 6, 2026. Also check server logs for a POST to /api/session/reset_password that returned a 400 status followed by a GET to /api/user/current, which Metabase says signals compromise.

Update Metabase through its normal update channel, then confirm the installed version matches the newest vendor release.

Technical details

The flaw, tracked as GHSA-vwf4-m7j8-wcjf with a CVSS score of the latest version, is an unauthenticated SQL injection in Metabase's password reset endpoint. Successful exploitation lets a remote attacker inject arbitrary SQL into the application database, gaining administrator access to the instance. From there an attacker can change application configuration, steal stored credentials for connected data sources, read data through those connections, and export it.

Metabase says it blocked the abused endpoints and confirmed active exploitation before shipping fixes across every supported branch from the latest version to the latest version. No CVE ID has been assigned as of disclosure.

References

View Original Source