Critical Metabase SQL Injection Zero-Day Exploited in Data Breaches

Bleepingcomputer

Critical Metabase SQL Injection Zero-Day Exploited in Data Breaches

First seen 7 Aug 2026, 21:12 UTC • •78.0

Article Content

1 / 31

Browse articles

ThreatCluster •August 8, 2026 at 20:35 UTC

•A critical SQL injection vulnerability in Metabase allows remote attackers administrator access.
•The vulnerability affects versions 1.58 and above, with active exploitation confirmed.
•Metabase has rolled out patches for Cloud customers and provided guidance for self-hosted users.

A critical SQL injection vulnerability in Metabase was exploited in zero-day attacks, affecting versions 1.58 and above. The vulnerability allows unauthenticated remote attackers to gain administrator access to customer instances. Metabase confirmed that its Cloud SaaS platform was compromised, impacting customers including Framework and Tally. The vulnerability has a CVSS score of 10.0 and has been actively exploited, although no CVE identifier has been assigned yet. Metabase has patched the vulnerability for its Cloud customers and provided guidance for self-hosted installations. Organizations are urged to upgrade immediately and review their security configurations. The attacks can be identified through specific log patterns indicating compromise. Metabase recommends blocking the '/api/session/reset_password' endpoint as a temporary measure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 92d ago How this analysis works

Timeline

2026-08-07

Metabase discloses zero-day vulnerability

Metabase announced a critical SQL injection vulnerability exploited in attacks affecting versions 1.58 and above.

Bleepingcomputer

2026-08-07

Framework confirms data breach

Laptop maker Framework reported that customer information was stolen following the compromise of its Metabase instance.

Bleepingcomputer

2026-08-07

Metabase patches vulnerability

Metabase rolled out patches for its Cloud customers and provided upgrade instructions for self-hosted installations.

More articles in this cluster (30)

Threat Graph

9 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Data Breach
Sql Injection
Zero-day Exploit
T1190 - Exploit Public-Facing Application

Organization (4)

Framework
LexisNexis
Metabase
Tally

Weakness (1)

CWE-89 - SQL Injection

Relationships

Data Breach related to Sql Injection
Data Breach related to Zero-day Exploit
Data Breach related to Framework
Data Breach related to LexisNexis
Data Breach related to Metabase
Data Breach related to Tally
Data Breach related to CWE-89 - SQL Injection
Data Breach related to T1190 - Exploit Public-Facing Application

Following this threat?

Track Framework in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…

GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…