Back Securityaffairs.Co

Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data

Securityaffairs.Co •Pierluigi Paganini • August 8, 2026

Attackers exploited a CVSS 10 Metabase zero-day to gain admin access and steal sensitive data. Framework confirmed it was among the victims. Metabase just confirmed something no analytics vendor wants to write: attackers found and used an unpatched, maximum-severity flaw against Metabase Cloud before anyone on the defense side knew it existed. The company’s own […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Metabase SQL Injection Zero-Day Exploited in Data Breaches A critical SQL injection vulnerability in Metabase was exploited in zero-day attacks, affecting versions 1.58 and above. The vulnerability allows unauthenticated remote attackers to gain administrator access to customer instances. Metabase confirmed that its Cloud SaaS platform was compromised, impacting customers including Framework and Tally. The vulnerability has a CVSS score of 10.0 and has been actively exploited, although no CVE identifier has been assigned yet. Metabase has patched the vulnerability for its Cloud customers and provided guidance for self-hosted installations. Organizations are urged to upgrade immediately and review their security configurations. The attacks can be identified through specific log patterns indicating compromise. Metabase recommends blocking the '/api/session/reset_password' endpoint as a temporary measure. 28 sources 78

Extracted Entities

Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (1)

Vulnerabilities (1)