Metabase, the widely used open-source business intelligence and data visualization platform, has confirmed that a critical zero-day vulnerability tracked as GHSA-vwf4-m7j8-wcjf was actively exploited in the wild, allowing unauthenticated attackers to seize full administrator access to affected instances.
The flaw carries a maximum CVSS score of 10.0 and impacts every release from version 1.58 onward, spanning branches 0.58 through 0.63. Although no CVE identifier has been assigned as of this writing, the severity and confirmed real-world exploitation make this one of the most dangerous business intelligence platform vulnerabilities disclosed this year.
The vulnerability is an unauthenticated SQL injection flaw that lives in the publicly reachable POST /api/session/reset_password endpoint. An attacker who reaches this endpoint can inject arbitrary SQL statements directly into the Metabase application database without ever logging in.
Metabase 0-Day Vulnerability
Once the injection succeeds, the attacker can manipulate database records to promote themselves to an administrator account, effectively gaining full control of the instance.
From that privileged position, the attacker can alter application configuration settings, extract stored credentials for every database connected to Metabase, read any data reachable through those connections, and export sensitive records at will.
Metabase first detected the abuse after its own Metabase Cloud SaaS platform was breached on August 3, when someone leveraged the previously unknown flaw to compromise customer instances. The company blocked the malicious endpoints and shipped a patch within hours, and all Metabase Cloud customers were automatically upgraded and protected.
Self-hosted deployments, however, remain exposed until administrators apply the fix themselves. Data theft incidents linked to this zero-day have already been disclosed by at least two companies, Framework and Tally, both of which reported unauthorized access to customer information including names, addresses, phone numbers, and emails.
Defenders can look for a distinctive attack signature in their web server or application logs: a call to POST /api/session/reset_password that returns a 400 status code, immediately followed by a call to GET /api/user/current returning a 200 status code. This pattern indicates the exploit chain succeeded in generating an authenticated session, and any instance showing these log entries should be treated as compromised.
Administrators running self-hosted Metabase must upgrade immediately to the minimum safe patched release for their branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5. Versions below 0.58 are not affected by this particular flaw.
If the password reset endpoint was publicly reachable before patching, security teams should also revoke all active sessions by clearing the core_session table, audit API keys for anything unrecognized, review administrator accounts for unexpected changes, rotate credentials for every connected database, and comb through data warehouse and Metabase query logs for signs of unauthorized activity.
Business intelligence tools like Metabase often sit at the center of an organization’s data ecosystem, holding privileged credentials to multiple backend databases simultaneously.
That makes a single unauthenticated SQL injection flaw exceptionally dangerous, since compromising one BI instance can cascade into a much larger breach of connected systems.
Organizations running self-hosted Metabase should treat patching as urgent, not routine, and assume compromise if the telltale log pattern appears anywhere in their infrastructure.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access appeared first on Cyber Security News.
