--- title: Metabase SQL injection zero-day exploited in the wild,... description: A critical unauthenticated SQL injection zero-day (CVSS 10.0) in Metabase versions 1.58 and above has been actively exploited in the wild. Attackers can inject... canonical: https://daily.dev/posts/metabase-sql-injection-zero-day-exploited-in-the-wild-framework-among-confirmed-victims-s8tq7kmtu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Metabase SQL injection zero-day exploited in the wild, Framework among confirmed victims | daily.dev og:description: A critical unauthenticated SQL injection zero-day (CVSS 10.0) in Metabase versions 1.58 and above has been actively exploited in the wild. Attackers can inject... og:url: https://daily.dev/posts/metabase-sql-injection-zero-day-exploited-in-the-wild-framework-among-confirmed-victims-s8tq7kmtu og:image: https://api.daily.dev/og/posts/s8tq7KMtu.png og:image:alt: Metabase SQL injection zero-day exploited in the wild, Framework among confirmed victims og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Metabase SQL injection zero-day exploited in the wild, Framework among confirmed victims **[Collections](https://daily.dev/sources/collections)** · 4 min read · 2 upvotes · 0 comments ## Summary A critical unauthenticated SQL injection zero-day (CVSS 10.0) in Metabase versions 1.58 and above has been actively exploited in the wild. Attackers can inject arbitrary SQL against the Metabase application database without authentication, gaining admin access, stealing stored credentials, and exfiltrating data. Confirmed victims include laptop maker Framework (names, emails, phone numbers, addresses stolen), form builder Tally (emails and hashed passwords), and LexisNexis via a third-party vendor. Metabase Cloud has been patched automatically; self-hosted users must upgrade manually to specific safe releases (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5). A temporary mitigation is to block the `/api/session/reset_password` endpoint. Post-patch, admins should run `TRUNCATE TABLE core_session` to invalidate any attacker-established sessions, revoke active sessions, and rotate stored credentials. ## Content A maximum-severity SQL injection flaw in Metabase — later tracked as CVE-2026-72898 with a perfect CVSS score of 10 — has been actively exploited since late July 2026, and the fallout is still spreading through the companies that rely on Metabase for internal analytics. ## The vulnerability The bug affects Metabase versions 1.58 and above and lives in the `/api/session/reset_password` endpoint. Attackers send a POST request there (which returns a 400) followed by a GET to `/api/user/current` (which returns 200) — and just like that, they have raw SQL access to the application database. From there it's a short hop to administrator access: steal credentials, read whatever data is stored, rewrite configurations, or just wreck things. The root cause is almost mundane for something this severe: Metabase doesn't use prepared statements in this code path, partly because it needs to support a huge range of SQL database backends and prepared statements get complicated across that many dialects. Understandable as an engineering constraint. Still a CVSS 10. About 2,500 Metabase instances are directly exposed to the internet, and roughly a quarter of self-hosted cloud deployments are fully accessible online — which is to say, a lot of surface area for something this easy to exploit. ## Who's affected, and what to do about it Metabase Cloud customers were patched automatically, so if that's you, you're covered. Self-hosted users are not so lucky and need to manually upgrade to one of the safe releases: - 0.58.24 (later hardened further to 0.58.28) - 0.59.21 (0.59.25) - 0.60.17 (0.60.21) - 0.61.11 (0.61.15) - 0.62.9 (0.62.13) - 0.63.5 (0.63.10) Metabase pushed a second round of hardened point releases the following week to close derivative issues, and the company says it's pausing feature work in favor of weekly security- and observability-focused releases for now. It also credited DOS, Ophion Security, and Anthropic for helping identify problem areas during its internal review — a somewhat unusual credit line, but here we are. If you can't upgrade immediately, block the `/api/session/reset_password` endpoint. If that endpoint has been publicly reachable, also run `TRUNCATE TABLE core_session` after upgrading, since old sessions could still be valid. Beyond that, Metabase's remediation checklist calls for rotating all credentials, revoking active sessions, auditing admin accounts, and reviewing query histories and logs for anything that looks off. ## Confirmed victims The list of breached organizations keeps growing, and the range of stolen data varies quite a bit depending on what each company had connected to Metabase: - **Framework**, the modular/repairable laptop maker, had names, emails, physical addresses, and phone numbers stolen for its full customer base. Payment information wasn't touched. - **Tally**, the form builder, had emails and hashed passwords exposed. - **LexisNexis** saw its Metabase API disrupted through a third-party vendor. - **n8n** disclosed 136 customer records stolen, including 25 with plaintext passwords — which is its own separate problem. - **Kilo Code**, an AI coding startup, confirmed a breach on August 2 that also exposed Slack access tokens. - **ChecklyHQ** was also hit, with usernames, emails, and API keys among the stolen data. - **Cypress** reported that an attacker exploited the vulnerability in Metabase's cloud platform on July 31, 2026, accessing business and account data, repository and build metadata, and in some cases tokens and test data. Cypress says test run operations, record keys, account passwords, and billing information were unaffected. The company rotated database credentials, revoked GitHub OAuth sign-in tokens, audited access logs, and brought in an independent forensic firm. If you're a Cypress user, the advice is to rotate any secrets in build parameters or test data, rotate long-lived version control tokens used in CI, check version control access logs from July 31 onward, and keep an eye out for phishing attempts riding on the leaked data. ## The Framework breach, in more detail Framework's situation is worth dwelling on because it's a good case study in both what went right and what people are (fairly) annoyed about. Metabase notified Framework within three days of discovering the breach. Framework then notified its customers within six hours of getting that notice. That's fast — genuinely fast — and a lot of the community reaction has been appreciative of the transparency and speed. But not everyone's happy. Some customers pushed back on Framework's use of the word ## Questions this post answers ### What versions of Metabase fix the CVE-2026-72898 SQL injection vulnerability? Self-hosted Metabase users need to upgrade to one of the hardened releases: 0.58.28, 0.59.25, 0.60.21, 0.61.15, 0.62.13, or 0.63.10, which supersede an earlier round of patches (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5) that left derivative issues unresolved. Metabase Cloud customers were patched automatically and do not need to take action. _Track Metabase's staggered patch releases on daily.dev before deciding which version to deploy._ ### How does the Metabase CVE-2026-72898 SQL injection exploit work? Attackers send a POST request to the /api/session/reset_password endpoint, which returns a 400 error, followed by a GET request to /api/user/current, which returns 200 - granting raw SQL access to the application database and a short path to administrator access. The root cause is that this code path doesn't use prepared statements, partly because Metabase supports many SQL database backends. _Security teams patching against active SQL injection exploits can follow developments like this on daily.dev._ ### What should I do if my self-hosted Metabase instance was exposed to the reset_password endpoint vulnerability? Block the /api/session/reset_password endpoint immediately if you cannot upgrade right away, and if that endpoint was ever publicly reachable, run TRUNCATE TABLE core_session after upgrading since old sessions may remain valid. Metabase's full remediation checklist also calls for rotating all credentials, revoking active sessions, auditing admin accounts, and reviewing query histories and logs. _Following incident remediation steps like these on daily.dev helps teams respond faster to critical CVEs._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 49 comments across hackernews (as of 2026-09-13). **TL;DR:** Commenters broadly criticize Framework for sharing extensive PII with a third-party analytics platform in the first place, and debate whether the breach response was truly praiseworthy or merely adequate; a vocal minority defends the speed of notification while others demand tangible compensation and stricter data minimization practices. **Sentiment:** 20% positive · 35% mixed · 45% skeptical **The case for** - Framework notified affected customers within 6 hours of receiving Metabase's disclosure, which many consider commendably fast. - Metabase itself acted quickly — patching the vulnerability, notifying law enforcement, and alerting customers within 3 days of discovery. - Framework proactively notified customers even in regions where regulations don't require notification for this type of data. **The pushback** - Storing names, addresses, phone numbers, login IPs, and VAT/EIN data in a third-party analytics platform was seen as unnecessary and irresponsible data minimization failure. - PII like names and addresses cannot be changed the way passwords or credit card numbers can, making this breach particularly harmful long-term. - Some affected users never completed a purchase — they merely filled in checkout fields — yet their data was still retained and exposed. - No tangible compensation (discount, credit, or legal action against Metabase) was offered, only an apology. - Even customers in GDPR-regulated regions were affected, suggesting legal compliance alone is insufficient protection. - The breach opens the door to highly convincing targeted phishing attacks using the leaked data. **By community** - hackernews (skeptical): Commenters are largely critical of the decision to share extensive PII with a third-party SaaS platform, question whether Framework's response deserves praise, and call for stronger data minimization laws and tangible accountability rather than apologies. **Hottest debate:** Whether Framework's rapid notification response deserves genuine praise or is merely the bare minimum given that the underlying problem — sharing broad PII with a third-party analytics vendor — was avoidable. **Open questions** - Why was so much PII (including login IPs, phone numbers, and business tax IDs) stored in a business intelligence/analytics platform at all? - What recourse do affected customers have, and will Framework offer any compensation beyond an apology? - Should companies be legally prohibited from sharing PII with third-party SaaS vendors unless strictly necessary, and how would analytics and CRM tools function under such a regime? - How can companies use analytics tools without exposing raw customer PII — e.g., via pseudonymization or on-premise deployments? **Highlights** > I say this as a fan of a lot of what Framework is doing. Lets not pretend we do not all -know- virtually every SaaS sucks ass at security because it slows down sales. Companies that use these easy button services anyway are knowingly putting PII at risk and any liability should fall on those decision makers. If you do not have the security and infra staff to take user data in house securely, in highly auditable secure enclaves, then you should not store it at all. > — [lrvick on hackernews · 2 comments](https://news.ycombinator.com/item?id=49206801) > While I'm impressed with Framework's handling of this issue, I can't help but notice how this was yet another analytics platform breach. CRM tools and analytics platforms (Salesforce, Mixpanel, now Metabase - I'm sure I'm forgetting some) are common vectors to get access to customer metadata these days. I don't see a solution to this in the near future. I initially thought up something quite simple: assign every customer a unique ID and use that where possible to reference a customer. That solution, however, renders the analytics and CRM tools nearly useless. There has to be a better way, though, other than haphazardly giving out customer metadata to other vendors. All of that information should stay in-house. As for why metadata is important: I've said this before, but metadata can't easily be changed. I'd much prefer having my password or credit card number leaked in plaintext since I can change those identifiers trivially. I can't change my name, phone number, or address as easily. > — [parable on hackernews · 3 comments](https://news.ycombinator.com/item?id=49206576) > > I'm impressed with Framework's handling of this issue I'm not. I'd like to see some sort of tangible compensation from them, not just a "we're sorry". Maybe a discount code or a freebie, or actual hard cash. I'd also like to see them pursue legal action against Metabase. And finally, I'd like them to be upfront with how they store and use PII. Had I known that they were going go store it with a third-party - and that too, unsalted and unencrypted - I would've never even signed up. > — [d3Xt3r on hackernews](https://news.ycombinator.com/item?id=49209487) > At some point I almost bought a Framework laptop, just didn't click the Order button. I had my address etc already filled in, so because of that I also got that email from Framework this morning. From a technical perspective I guess it makes sense that Metabase has my personal information, but it's still kind of crazy to think how much personal information you're sending "out there" just by, for example, checking a final price of a product including shipping. > — [wkjagt on hackernews · 1 comments](https://news.ycombinator.com/item?id=49208762) > There's no reason Framework needed to be storing this much PII about me all this time including my address, IP addresses and phone number. I just requested a full delete courtesy of GDPR and CCPA and encourage others to do the same. > — [hellcow on hackernews](https://news.ycombinator.com/item?id=49206692) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49206130) · 110 points · 49 comments ## Similar posts on daily.dev - [August 2026 Security Vulnerability: What happened?](https://daily.dev/posts/august-2026-security-vulnerability-what-happened--vf4dqe4hg) · Metabase · 6 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#data-breach](https://daily.dev/tags/data-breach), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/metabase-sql-injection-zero-day-exploited-in-the-wild-framework-among-confirmed-victims-s8tq7kmtu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Metabase SQL injection zero-day exploited in the wild, Framework among confirmed victims","url":"https://daily.dev/posts/metabase-sql-injection-zero-day-exploited-in-the-wild-framework-among-confirmed-victims-s8tq7kmtu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/metabase-sql-injection-zero-day-exploited-in-the-wild-framework-among-confirmed-victims-s8tq7kmtu"},"datePublished":"2026-08-07T20:19:21.572Z","dateModified":"2026-09-13T19:44:42.317Z","description":"A critical unauthenticated SQL injection zero-day (CVSS 10.0) in Metabase versions 1.58 and above has been actively exploited in the wild. Attackers can inject...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1034bde6b6cf243e0096aa70b41b46a2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1034bde6b6cf243e0096aa70b41b46a2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/metabase-sql-injection-zero-day-exploited-in-the-wild-framework-among-confirmed-victims-s8tq7kmtu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,data-breach,zero-day","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Metabase SQL injection zero-day exploited in the wild, Framework among confirmed victims"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/metabase-sql-injection-zero-day-exploited-in-the-wild-framework-among-confirmed-victims-s8tq7kmtu#faq","mainEntity":[{"@type":"Question","name":"What versions of Metabase fix the CVE-2026-72898 SQL injection vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Self-hosted Metabase users need to upgrade to one of the hardened releases: 0.58.28, 0.59.25, 0.60.21, 0.61.15, 0.62.13, or 0.63.10, which supersede an earlier round of patches (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5) that left derivative issues unresolved. Metabase Cloud customers were patched automatically and do not need to take action. Track Metabase's staggered patch releases on daily.dev before deciding which version to deploy."}},{"@type":"Question","name":"How does the Metabase CVE-2026-72898 SQL injection exploit work?","acceptedAnswer":{"@type":"Answer","text":"Attackers send a POST request to the /api/session/reset_password endpoint, which returns a 400 error, followed by a GET request to /api/user/current, which returns 200 - granting raw SQL access to the application database and a short path to administrator access. The root cause is that this code path doesn't use prepared statements, partly because Metabase supports many SQL database backends. Security teams patching against active SQL injection exploits can follow developments like this on daily.dev."}},{"@type":"Question","name":"What should I do if my self-hosted Metabase instance was exposed to the reset_password endpoint vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Block the /api/session/reset_password endpoint immediately if you cannot upgrade right away, and if that endpoint was ever publicly reachable, run TRUNCATE TABLE core_session after upgrading since old sessions may remain valid. Metabase's full remediation checklist also calls for rotating all credentials, revoking active sessions, auditing admin accounts, and reviewing query histories and logs. Following incident remediation steps like these on daily.dev helps teams respond faster to critical CVEs."}}]} ```