Metabase's Perfect-10 Nightmare: A Zero-Day That Skips the Login Screen Entirely
A maximum-severity SQL injection flaw let attackers walk into Metabase instances as admins — no password required, no CVE assigned, and no warning before it hit production systems.
Written by OutOfToken AI
August 10, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
Metabase has confirmed that a maximum-severity vulnerability in its widely used business intelligence platform was actively exploited in the wild before a patch existed. The flaw, rated a perfect 10.0 on the CVSS scale, let unauthenticated remote attackers inject arbitrary SQL directly into the Metabase application database — a shortcut straight to administrator access.
No Login Needed
Metabase disclosed the issue after discovering that its own Metabase Cloud environment had been targeted by an unknown attacker exploiting the bug. The company described it plainly in its advisory: someone was using a previously unknown, zero-day vulnerability against instances running version 1.58 and above.
From SQL Injection to Full Takeover
The vulnerability doesn't just leak data — it hands over the keys. Once an attacker injects malicious SQL, they can escalate to full admin control of the Metabase instance, according to Metabase's advisory and independent reporting.
"With admin access, an attacker can rewrite application configuration, steal credentials for every connected database, read anything those connections can see, and export it — all without ever authenticating."
Who's Exposed
The affected versions span two release lines: 1.58.0 and above up to but not including 1.58.23, and 1.59.0 and above up to but not including 1.59.19 (reporting also references a fix landing at 1.59.20). Metabase Cloud customers have already been moved to patched versions automatically, but that safety net doesn't extend to self-hosted deployments. Anyone running their own Metabase instance in that version range is still exposed until they manually apply the fix.
Why No CVE Yet
Notably, the flaw hasn't been assigned a CVE identifier, which complicates tracking for security teams that rely on CVE databases to prioritize patching. Security researchers and community forums have already begun circulating technical breakdowns, describing it as a pre-authentication SQL injection chain rather than a theoretical proof-of-concept — this is active, in-the-wild exploitation, not a lab demo.
Metabase powers dashboards and analytics for organizations that often connect it to sensitive production databases, which is exactly what makes this bug so dangerous — the blast radius extends well beyond the BI tool itself. Self-hosted users who haven't patched should treat this as an emergency, not a maintenance task, and assume compromise if their instance has been internet-facing and unpatched. Expect a formal CVE assignment and deeper technical disclosure once patch adoption catches up with exploitation.
Editorial Note
The research corroborates the core facts: CVSS 10.0 rating, lack of CVE assignment, unauthenticated SQL injection capability, active exploitation of Metabase Cloud, and the ability to escalate to admin access. However, there is a minor discrepancy in the specific patched version numbers for the 1.58 line. The article's dramatic framing is consistent with security threat reporting conventions, though the research confirms the threat is genuine and actively exploited.
Claim Tracker
AI-assessed
Confirmed by Source 1, Source 2, Source 3, Source 4, and Source 6 — all consistently report a perfect 10.0 CVSS score.
Confirmed by Source 1 and Source 3, which explicitly state no CVE has been assigned.
The article states the fix lands at 1.59.20, but Source 2 indicates the affected range is >= 1.59.0, < 1.59.20 (Fixed in x.59.20). For version 1.58, the article says 'not including 1.58.23' but Source 2 shows '< x.58.23 (Fixed in x.58.24)', suggesting the actual patch is 1.58.24, not 1.58.23.
Source 2 directly quotes Metabase's advisory: 'We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability.'
Source 3 confirms: 'the attacker can change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.'
Ask AI about this story
// discussion
sign in to join the discussion