A Zero-Day SQL Injection Vulnerability in Metabase Cloud Threatens Widespread Consequences
A critical vulnerability has been discovered in Metabase Cloud, a business analytics platform used by numerous organizations worldwide. The zero-day SQL injection flaw allows attackers to gain remote administrator access to affected instances, compromising sensitive data and potentially leading to further attacks on downstream customers.
The vulnerability, which affects versions 1.58 of the platform and above, was disclosed last week by Metabase CEO Sameer Al-Sakran in a blog post. According to the company’s advisory posted on GitHub, exploitation of the flaw allows attackers to inject malicious SQL statements into the Metabase application database, granting them administrator access to the instance. This can be used to change application configuration, steal credentials for connected databases, read sensitive data, and export it.
The impact of this vulnerability is significant not only for Metabase customers but also for their downstream organizations. Metabase acts as a front end for processing data from a wide range of SQL databases, making the compromise of its platform a potential threat to numerous businesses that rely on its services. It’s unclear how many instances have been compromised, and whether self-hosted open-source versions were also affected.
According to Johannes Ullrich of the SANS Internet Storm Center, the vulnerable API endpoint must be reachable for exploitation to work. This means that organizations who have exposed the /api/session/reset_password endpoint on the public internet are still susceptible to attacks. As Ullrich points out, most users likely expose their instances rather than restricting individual API endpoints, which would require a more granular proxy configuration.
The use of SQL injection vulnerabilities is a common and frustrating software flaw that continues to plague organizations worldwide. In this case, the issue stems from Metabase’s database application not using prepared statements effectively. This omission makes it difficult for the platform to support a wide range of databases while also making it vulnerable to attacks like this one.
The blast radius for this attack is considerable, with potential consequences extending beyond Metabase customers and their downstream organizations. Several victims have already come to light, including n8n, a startup specializing in workflow automation, which disclosed that an attacker obtained 136 customer records containing sensitive information.
In light of this vulnerability, it’s essential for organizations using Metabase to take immediate action to protect themselves. This includes reviewing API endpoint configurations and ensuring that the /api/session/reset_password endpoint is not exposed on the public internet. Additionally, users should update their instances to fixed versions as soon as possible. By taking these steps, organizations can minimize their exposure to this critical vulnerability and prevent potential follow-on attacks.
Source: Dark Reading — 2026-08-10