Reported by 1 outlet
Metabase SQLi Zero-Day Now Patched — Every Self-Hosted Instance Still Needs an Upgrade
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.38 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Metabase SQLi Zero-Day Now Patched — Every Self-Hosted Instance Still Needs an Upgrade
securityweek.com · 65d ago · August 10th, 2026
Metabase shipped fixes for the unauthenticated SQL injection zero-day (tracked as GHSA-vwf4-m7j8-wcjf, CVSS 10.0) exploited since August 3 against its Cloud infrastructure, where attackers seized admin access and stole credentials for every connected database — Framework and Tally confirmed as victims. The flaw lives in the unauthenticated
POST /api/session/reset_passwordendpoint and affects branches 0.58.0–0.63.x plus equivalent 1.x releases; minimum safe versions are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5, all available as Docker images and JARs. Cloud is patched, but self-hosted deployments remain exposed until administrators upgrade manually — no CVE was assigned at disclosure, so NVD-based scanners will not flag affected instances. Treat any deployment whose logs show areset_password400 response immediately followed by a 200 on/api/user/currentas compromised, revoke all sessions, and audit admin accounts and API keys. -
mentioned by securityweek.com
Metabase Patches Vulnerability Exploited as Zero-Day
securityweek.com · 64d ago · August 10th, 2026