Zero-Day Critical Alert: Unauthenticated Metabase 0-Day SQL Injection Exploited for Full Admin Access (GHSA-vwf4-m7j8-wcjf)
Executive Summary
Open-source business intelligence platform Metabase issued an emergency advisory on August 9, 2026, confirming active in-the-wild exploitation of a critical zero-day vulnerability (tracked as GHSA-vwf4-m7j8-wcjf). Carrying a maximum CVSS score of 10.0, the flaw enables unauthenticated remote attackers to execute arbitrary SQL injection payloads directly against Metabase instance databases. By targeting an un-sanitized API endpoint, attackers achieve full administrative takeover over business intelligence dashboards, exfiltrating connected enterprise SQL databases, data warehouses, and analytics pipelines without valid user credentials.
Technical Analysis of the Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf)
The vulnerability stems from improper parameter sanitization inside Metabase's authentication workflow:
1. Unauthenticated Password Reset SQL Injection Endpoint
The flaw resides in a publicly reachable REST API endpoint:
* The Vulnerable Endpoint: Attackers send crafted HTTP POST requests to POST /api/session/reset_password, an endpoint accessible without prior authentication.
* SQL Injection Vector: Un-sanitized JSON request parameter inputs pass directly into raw database query constructors within the Metabase application backend. Attackers inject stacked SQL queries, overriding administrative user password hashes and inserting malicious admin accounts into the core_user table.
2. Impacted Versions & Full Platform Compromise
The zero-day affects every release from Metabase version 1.58 onward:
* Scope: Impacted versions span branches 0.58.x through 0.63.x across both Metabase Community and Enterprise editions.
* Downstream Database Risk: Upon gaining administrator control over a Metabase instance, attackers can execute arbitrary SQL queries against all connected corporate databases (PostgreSQL, Snowflake, BigQuery, Redshift), leading to enterprise-wide data exfiltration.
Vulnerability Metric
Details
Impacted Application
Metabase (Open-Source Business Intelligence Platform)
Vulnerability Identifier
GHSA-vwf4-m7j8-wcjf
CVSS Score
10.0 (Critical)
Target Endpoint
POST /api/session/reset_password
Impacted Versions
Metabase v1.58 through v0.63.x
Disclosed Date
August 9, 2026
Primary Threat
Unauthenticated Full Admin Takeover, SQL Database Exfiltration
Business Intelligence Infrastructure as an High-Value Target
The active exploitation of Metabase highlights the severe risks surrounding centralized business intelligence and data visualization platforms. Because Metabase instances sit at the intersection of enterprise data warehouses, a single unauthenticated RCE or SQL injection flaw provides attackers with direct access to an organization's most sensitive financial, operational, and customer databases.
Isolating business intelligence portals behind strict network access boundaries and enforcing immediate emergency updates are critical to preventing enterprise data exfiltration.
Recommendations and Mitigations
Enterprise IT administrators, SOC teams, and data engineers operating Metabase must execute immediate security controls:
1. Apply Metabase Emergency Security Patches Immediately: Upgrade Metabase instances to patched builds (v0.63.1, v1.63.1, or corresponding security releases) to neutralize GHSA-vwf4-m7j8-wcjf.
2. Restrict Public Exposure of Metabase API Endpoints: Remove direct internet exposure for Metabase instances, placing analytics portals behind zero-trust network access (ZTNA) or VPN gateways.
3. Audit Metabase core_user Database Logs for Unauthorized Admin Accounts: Inspect Metabase application database logs for newly created administrative users or anomalous password reset requests.
4. Enforce Least-Privilege Database Connection Credentials: Restrict database user accounts connected to Metabase to read-only permissions, preventing attackers from executing destructive SQL commands against underlying data warehouses.