Metabase, one of the most widely deployed open-source business intelligence tools, has confirmed that a maximum-severity zero-day vulnerability was exploited against live customer environments before a fix was available. Tracked as GHSA-vwf4-m7j8-wcjf and rated a perfect 10.0 on the CVSS scale, the flaw let attackers with no valid credentials seize full administrator control over affected instances.

An Unauthenticated Path Straight to Admin

The root cause is an unauthenticated SQL injection bug sitting in the publicly accessible POST /api/session/reset_password endpoint. Because the endpoint doesn’t require a login, anyone who can reach it can inject SQL statements directly against the underlying application database. From there, attackers can rewrite database records to promote an arbitrary account to administrator, effectively taking over the instance without ever authenticating.

Once inside, the attacker inherits everything an admin can see and touch: application configuration, stored credentials for every database Metabase connects to, and any data reachable through those connections. Because BI platforms like Metabase are typically wired into multiple production databases at once, a single compromised instance can cascade into a much broader breach.

Discovered the Hard Way

Metabase says it first learned of the flaw after its own Metabase Cloud SaaS platform was breached on August 3, when an attacker used the then-unknown bug to compromise customer instances. The company shut down the abused endpoint and shipped a patch within hours, automatically upgrading every Cloud customer. Self-hosted deployments were not so lucky — they remain exposed until administrators apply the update themselves.

At least two companies, Framework and Tally, have already disclosed that customer data — including names, addresses, phone numbers, and email addresses — was accessed through the flaw before it was patched.

How to Tell If You Were Hit

The vulnerability affects every release from version 1.58 through the 0.63 branch. Metabase has published a fairly specific forensic signature defenders can hunt for in web server or application logs:

• A call to POST /api/session/reset_password that returns HTTP 400
• Immediately followed by a call to GET /api/user/current returning HTTP 200

That sequence indicates the injection succeeded in minting an authenticated session, and any instance showing it should be treated as compromised rather than merely “at risk.”

Patch Now, Then Assume Compromise

Metabase is urging every self-hosted administrator to upgrade immediately to whichever of these is the minimum safe release for their branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5. Versions prior to 0.58 are not affected by this specific bug.

If the password reset endpoint was reachable from the public internet before the patch was applied, the company recommends treating the instance as potentially breached and taking several additional steps:

• Clear the core_session table to revoke all active sessions
• Audit API keys for anything unrecognized or unauthorized
• Review administrator accounts for unexpected additions or changes
• Rotate credentials for every database connected to the instance
• Comb through query logs and connected data warehouses for signs of unauthorized access

Why This Matters Beyond Metabase

Business intelligence platforms occupy a privileged position in most organizations’ infrastructure — they hold live credentials to numerous backend systems simply to do their job. That makes an unauthenticated, no-login-required SQL injection flaw in a BI tool disproportionately dangerous compared to a similar bug in a more isolated application. Security teams that run Metabase, self-hosted or otherwise, should treat this patch as an emergency change rather than something to schedule into a routine maintenance window, and should assume compromise until the log review above comes back clean.