Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
- ID
- 12196
- Status
- summarized
- Published
- 08 Aug 2026, 2:58 PM
- Fetched
- 08 Aug 2026, 4:05 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.5
- Created
- 08 Aug 2026, 4:06 PM
- Tags
- Audience
- developersdatabase_learnerssaas_founders
What happened
A CVSS 10.0 zero-day in Metabase is being actively exploited to grant unauthenticated attackers admin access via SQL injection into the application database. Self-hosted instances running versions 1.58 and above are affected and must be patched to specific fixed versions (e.g., x.58.24, x.59.21, x.60.17) immediately.
Why it matters
If you run self-hosted Metabase, patch to the fixed version immediately or block the "/api/session/reset_password" endpoint as a temporary workaround. Because attackers can steal stored credentials for connected databases, you must rotate those credentials and check for the specific Indicators of Compromise (POST /api/session/reset_password returning 400 followed by GET /api/user/current returning 200) if your instance was exposed.
Discussion angle
The downstream risk of BI tool vulnerabilities: how an admin compromise in a visualization tool like Metabase can cascade into full data warehouse breaches via stolen connected database credentials.