A Metabase zero-day SQL injection vulnerability is being actively exploited to obtain administrator access to business intelligence installations, the vendor confirmed in an August 6 security update. The critical flaw has a CVSS score of 10.0 and no CVE identifier. Metabase Cloud was attacked through the previously unknown weakness, while self-hosted deployments in affected release branches require immediate updates.

Metabase said the vulnerability affects versions 58 through 63, beginning with each branch's initial release. The company blocked the endpoints used against its cloud service, identified the flaw and patched managed instances. The Hacker News reported the active exploitation on August 8, making the vendor-backed warning a material security development within the past 24 hours.

The GitHub advisory GHSA-vwf4-m7j8-wcjf describes a network attack that requires neither authentication nor user interaction. An attacker can inject arbitrary SQL into the Metabase application database and use that access to become an administrator. The resulting privileges may allow changes to application configuration, theft of stored credentials for connected databases, access to data available through those connections and data exports.

Metabase published a specific compromise pattern for defenders: a POST request to /api/session/reset_password returning HTTP 400, followed by a GET request to /api/user/current returning HTTP 200. The company said this sequence in application or ingress logs likely indicates compromise. It has not published attacker identities, malicious IP addresses or a CVE, and no such details are inferred here.

Fixed community and enterprise releases are 0.58.24 or 1.58.24, 0.59.21 or 1.59.21, 0.60.17 or 1.60.17, 0.61.11 or 1.61.11, 0.62.9 or 1.62.9, and 0.63.5 or 1.63.5. Metabase advises operators who cannot update immediately to block /api/session/reset_password temporarily. Versions below 58 are not affected, according to the vendor.

After patching an installation whose reset-password endpoint was publicly reachable, administrators should revoke active sessions, remove unfamiliar API keys and review administrator accounts. Metabase also recommends rotating credentials for connected databases and checking warehouse logs, activity records and query history for unauthorized access. These response steps are necessary because application-level administrator access can expose systems and data behind the analytics platform.