Metabase SQLi zero-day exploited in customer data-theft attacks
A perfect-10 severity flaw in the popular analytics tool let attackers walk into admin accounts unauthenticated — and Framework, Tally, and LexisNexis paid the price.
Written by OutOfToken AI
August 10, 2026 · 4 min read · Synthesized from reporting by BleepingComputer · How this works
A critical, unauthenticated SQL injection vulnerability in Metabase has been actively exploited in zero-day attacks that breached customer instances and siphoned off sensitive data. The flaw, rated a maximum CVSS score of 10.0, hit versions 1.58 and above of the widely used business intelligence platform. Confirmed victims include laptop maker Framework, business software provider Tally, and data broker LexisNexis.
How the attack worked
The vulnerability lives in the `/api/session/reset_password` endpoint, a password-reset function that attackers manipulated through SQL injection to bypass authentication entirely. No login credentials were needed — just crafted requests to that single API path. Once inside, attackers landed with full administrator privileges on the compromised Metabase instance.
What admin access bought them
Administrator rights on a business intelligence platform are a goldmine. Attackers reportedly used the access to steal database credentials, exfiltrate customer data, and alter instance configurations. Because Metabase connects directly to organizations' underlying databases to power dashboards and reports, a compromised instance can expose far more than what's visible on a chart.
"CVSS 10.0 — the highest possible severity score — reflects a flaw requiring zero authentication and delivering full administrative takeover."
Patch status and exposure window
Metabase Cloud customers were patched automatically, closing off exposure without any action required on their end. Self-hosted deployments are a different story: administrators running their own Metabase infrastructure must manually upgrade to one of the fixed releases — 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 — to close the hole. Exploitation activity has been traced back to early August 2026, meaning unpatched self-hosted instances could have been exposed for a meaningful window before fixes were applied.
Why the victim list matters
Framework, Tally, and LexisNexis aren't small operations — they represent hardware manufacturing, business software, and data aggregation respectively, each holding troves of customer and operational data. Their exposure underscores how deeply BI tools like Metabase are wired into corporate data pipelines. A single flaw in the dashboard layer becomes a direct pipe into the databases behind it.
For organizations still running self-hosted Metabase, the immediate priority is verifying patch status against the fixed version list or blocking the `/api/session/reset_password` endpoint as a stopgap. The incident is a pointed reminder that analytics and BI layers, often treated as secondary infrastructure, sit close enough to raw data stores that a single unauthenticated flaw can cascade into a full breach.
Editorial Note
The research corroborates the core narrative: a CVSS 10.0 SQL injection zero-day in Metabase 1.58+ actively exploited in August 2026, affecting Framework and Tally with automatic patching for Cloud customers and manual upgrade paths for self-hosted. However, LexisNexis is presented as a confirmed victim in the article but appears unsupported in the provided research sources, and the specific vulnerable endpoint (`/api/session/reset_password`) is not independently confirmed by any source.
Claim Tracker
AI-assessed
Source 1 and Source 5 both confirm 'CVSS 10.0' rating and 'versions 1.58 and above' affected by unauthenticated SQL injection zero-day.
The article claims this specific endpoint but none of the provided research sources mention the `/api/session/reset_password` endpoint by name. This detail is not corroborated in the research.
Sources 1, 3, 4, and 6 confirm Framework and Tally as victims. However, LexisNexis is mentioned in the article but no source in the research confirms LexisNexis as a confirmed victim—only Framework and Tally are consistently cited.
Source 1 lists these exact patched version numbers: '0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5.'
Source 6 mentions 'exploited around Aug 3, 2026' which is slightly more specific than 'early August,' but the article's phrasing is consistent with available data. Sources confirm August 2026 exploitation window but with varying precision.
Ask AI about this story
// discussion
sign in to join the discussion