Metabase SQL injection zero-day exploited in the wild: Framework, Tally, LexisNexis customer data stolen (CVSS 10.0)

Metabase disclosed an unauthenticated SQL injection zero-day in self-hosted editions (GHSA-vwf4-m7j8-wcjf, CVSS 10.0). Attackers need no credentials to become instance admin and steal connected-database credentials; Framework, Tally, and LexisNexis confirmed customer-data theft. Affects 0.58.x through 0.63.x.

On 7 August 2026, open-source BI tool Metabase disclosed an unauthenticated SQL injection zero-day in self-hosted deployments, advisory GHSA-vwf4-m7j8-wcjf, CVSS v3.1 10.0, no CVE assigned. Remote attackers can inject arbitrary SQL into the Metabase application database with no credentials, escalate to instance admin, and read or export credentials and business data from all connected databases. The next day, modular laptop maker Framework, online form platform Tally, and legal-data giant LexisNexis independently confirmed customer-data theft. Attacks date back to 3 August.

Incident overview

Per Metabase's advisory and BleepingComputer, attackers began organized hits against internet-exposed Metabase instances on 3 August. The flaw sits in the public password-reset endpoint `/api/session/reset_password` and requires no login. Metabase identified it on 6 August, hotfixed the cloud edition, and emailed affected customers. Self-hosted users must manually upgrade to these minimum safe versions: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5. On 7 August, Framework and Tally confirmed successful compromise in their own disclosures; LexisNexis was hit via a third-party vendor.

Technical details

Unauthenticated SQL injection. Attackers embed malicious SQL in the request body and POST it to `/api/session/reset_password` on the public internet. Metabase's password-reset controller concatenates user input into a template without adequate parameterization, so the injection bypasses auth and hits the application datastore.

Full attack chain, two stages:

• Stage A (privilege escalation): POST a crafted payload to `/api/session/reset_password`. Server returns `HTTP 400`, but a subsequent `GET /api/user/current` yields `HTTP 200` — attacker is already executing in an admin context.
• Stage B (data theft): With admin rights, enumerate configured API Keys and connected-database entries, read plaintext database connection credentials stored in the Metabase application database, then use those credentials as a legitimate BI account to access the data warehouse and bulk-export.

Metabase warns that instance system logs in this context may be tampered with. External immutable logs (syslog / SIEM mirrors) are the key forensic evidence.

Impact

Metabase is a free BI tool with a large SMB install base, commonly used as an internal dashboard and database query panel. Compromise of a BI instance yields not a small amount of tool data but access rights and credentials for every upstream database it connects to. Confirmed incidents:

• Framework: customer names, emails, login IPs, billing and shipping addresses, phone numbers, company names stolen; payment data not involved.
• Tally: email addresses and password hashes accessed; form data lives on a separate system, so attackers did not reach forms or submissions.
• LexisNexis: Metabase exposed via a third-party vendor was breached; the company cut related APIs but has not publicly confirmed further data exfiltration.

Core risk of BI credential leak is piggyback exfil: attackers use the tool's legitimate privileges to export data at the database layer, so DB-side audit struggles to tell good from bad. Metabase says some environments saw large-volume `INSERT` and export jobs, but attackers used normal BI-user sessions, consistent with access gained via stolen credentials.

Remediation

• Patch now: upgrade self-hosted Metabase to the current branch's minimum safe version (0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5) and confirm the version in Admin → Settings → About.
• Network shrink: restrict the Metabase HTTP API and `/api/session/reset_password` to intranet or VPN; do not expose it to the internet. At minimum, put a WAF or reverse proxy in front with a temporary deny rule for that endpoint.
• Rotate credentials: treat every database account stored by the instance as stolen. Immediately rotate least-privilege read-only accounts and disable any prior DBA / full-read accounts.
• Session and log review: backtrack admin-account and API Key creation since 3 August; hunt bulk export requests at unusual times or from unusual source IPs; ship logs to a non-writable external SIEM.
• Alerting: in reverse-proxy / WAF / SIEM logs, add Metabase's official IOC: `POST /api/session/reset_password → HTTP 400` immediately followed by `GET /api/user/current → HTTP 200` from the same session = high risk.

Sources

• Metabase security advisory GHSA-vwf4-m7j8-wcjf
• BleepingComputer Framework, Tally disclose Metabase data-theft incidents
• The Hacker News Metabase SQLi zero-day exploited in customer data-theft attacks
• hard2bit The Metabase zero-day: when your BI tool leaks your entire customer database
• AJ King Cyber Threat Brief — August 9 2026