A critical zero-day vulnerability has been discovered in the Metabase Cloud business-analytics platform, allowing malicious attackers to gain remote administrator access and potentially compromise downstream organizations.
The maximum-severity flaw, which has not yet been assigned a CVE identifier, affects versions 1.58 of the platform and above. According to an advisory posted on GitHub by Metabase, exploitation of the vulnerability allows an attacker to inject SQL statements into the application database, giving them control over the instance. From there, the attacker could alter configuration settings, steal stored credentials for connected databases, read sensitive data, and export it.
Metabase customers who have their instances hosted in the cloud do not need to take any action, as they will be automatically upgraded to fixed versions. However, self-hosted customers are still vulnerable if they expose the /api/session/reset_password endpoint on their public-facing networks. It is unclear how many customers have been impacted by the zero-day attacks, but security experts warn that downstream organizations could also be at risk.
The Metabase platform acts as a front end for processing data from various SQL databases, making it a potential conduit for sensitive information to flow into attacker’s hands. “Metabase can be installed as a Docker container and as a standalone Java application,” explains Johannes Ullrich of the SANS Internet Storm Center. “Either way, it exposes the API on port 3000 to the network.” If an attacker gains access to this endpoint, they could exploit the vulnerability.
The exploitation of SQL-injection vulnerabilities is all too common in the cybersecurity world. According to OWASP Top 10 lists, these flaws routinely top the list of most prevalent software issues. “It’s a simple issue that stems from not using prepared statements,” Ullrich says. “But it can be difficult for software like Metabase to use them effectively, as they need to support a wide range of databases.”
The potential impact of this zero-day vulnerability extends beyond Metabase customers themselves, warns Ullrich. Since Metabase acts as an intermediary between clients and their connected databases, a compromise could give attackers access to sensitive data that could be used in follow-on attacks against downstream organizations.
Several victims have already been identified, including n8n, a startup specializing in workflow automation. The company disclosed on August 8 that an attacker obtained 136 customer records. It is unclear how many other organizations may have been compromised.
The discovery of this vulnerability serves as a reminder to security professionals and organizations alike to prioritize the use of prepared statements and secure their API endpoints from public exposure. As Ullrich notes, “using prepared statements effectively can be difficult for software like Metabase,” but it’s an essential step in preventing such vulnerabilities. By staying vigilant and proactive in addressing these issues, we can reduce our collective risk and minimize the potential impact of zero-day attacks.
Source: Dark Reading — 2026-08-10