Reported by 2 outlets

Timeline

1. original reporting

   Metabase Zero-Day Attack Lets Hackers Gain Admin Access and Steal Database Credentials

   cyberpress.org · 64d ago · August 10th, 2026

   A maximum-severity, unauthenticated SQL injection zero-day in the popular open-source analytics platform Metabase has been actively exploited in the wild, letting attackers seize administrator privileges and steal credentials for every database connected to compromised instances. Metabase disclosed that its Cloud infrastructure was targeted starting around August 3, 2026, when attackers weaponized a previously unknown flaw affecting self-hosted and cloud deployments running version 1.58. The vulnerability, tracked as GHSA-vwf4-m7j8-wcjf and rated CVSS 10.0, resides in the unauthenticated POST /api/session/reset_password endpoint. Metabase Zero-Day Attack No CVE identifier had been assigned at the time of disclosure, meaning scanners relying solely on NVD feeds will not flag exposed instances. By sending crafted input to the password-reset endpoint, a remote attacker with no credentials can inject arbitrary SQL into Metabase’s application database. This grants full administrator access to the instance, allowing attackers to alter application configuration, harvest stored credentials for every connected data source, read accessible data, and export it in bulk. Metabase confirmed active exploitation against its Cloud environment before patching and blocking the abused endpoints. Reported victims include Framework and Tally customers, where unauthorized access reportedly exposed customer records such as names, emails, addresses, phone numbers, and company details. Metabase Cloud

2. update from gbhackers.com

   CISA Warns Critical Metabase SQL Injection Flaw Lets Unauthenticated Attackers Gain Admin Access

   gbhackers.com · 62d ago · August 12th, 2026

   Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical SQL injection vulnerability in Metabase, adding it to its Known Exploited Vulnerabilities (KEV) Catalog. Designated as CVE-2026-72898, this vulnerability was included in the KEV Catalog on August […] The post CISA Warns Critical Metabase SQL Injection Flaw Lets Unauthenticated Attackers Gain Admin Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   CISA Warns of Actively Exploited Metabase Flaw Enabling Admin Account Takeover

   cyberpress.org · 62d ago · August 12th, 2026

   A critical SQL injection vulnerability in Metabase, tracked as CVE-2026-72898, could allow unauthenticated remote attackers to compromise vulnerable instances and obtain administrator-level control. The flaw, classified under CWE-89, affects the application’s own database layer and creates a path to expose connected data sources, stored credentials, and sensitive business intelligence records. Organizations that operate Metabase, particularly internet-facing deployments, should treat the vulnerability as an immediate patching. Critical Metabase Flaw An attacker does not need valid Metabase credentials to exploit CVE-2026-72898. A remote adversary can inject arbitrary SQL statements into the Metabase application database, potentially altering data or manipulating application state. Unlike SQL injection flaws that are limited to extracting information from a single backend query, this vulnerability affects the database that supports Metabase itself. That distinction substantially raises the potential impact: the application database can contain user accounts, authorization settings, configuration values, session-related records, encrypted or stored connection details, and metadata describing connected data environments. An attacker able to manipulate those records could establish or elevate an account to administrator access. From there, the intrud