Metabase SQL injection zero-day exploited in the wild, Framework among confirmed victims
Questions this post answers
Which Metabase versions are affected by the unauthenticated SQL injection zero-day and what are the safe versions to upgrade to?
The unauthenticated SQL injection zero-day (CVSS 10.0) affects Metabase versions 1.58 and above. Safe minimum releases for self-hosted instances are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Metabase Cloud instances were patched automatically. As a temporary measure if patching is not immediately possible, blocking the `/api/session/reset_password` endpoint reduces exposure. Teams running self-hosted Metabase can track patch releases and related security advisories on daily.dev.
What log pattern should I look for to detect if my Metabase instance was targeted by the SQL injection exploit?
The attack leaves a recognizable two-step pattern in logs: a POST request to `/api/session/reset_password` returning a 400 error, followed by a GET to `/api/user/current` returning 200. After patching, running `TRUNCATE TABLE core_session` invalidates any sessions attackers may have established, and stored credentials in Metabase should be rotated. Developers investigating Metabase exposure find incident writeups and remediation guidance faster on daily.dev.