--- title: Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius description: A maximum-severity (CVSS 10) zero-day SQL injection vulnerability in Metabase Cloud is being actively exploited in the wild, affecting versions 1.58 and above.... canonical: https://daily.dev/posts/metabase-sql-zero-day-attacks-could-have-wide-blast-radius-zizravgao twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius | daily.dev og:description: A maximum-severity (CVSS 10) zero-day SQL injection vulnerability in Metabase Cloud is being actively exploited in the wild, affecting versions 1.58 and above.... og:url: https://daily.dev/posts/metabase-sql-zero-day-attacks-could-have-wide-blast-radius-zizravgao og:image: https://api.daily.dev/og/posts/zIZRavGAO.png og:image:alt: Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A maximum-severity (CVSS 10) zero-day SQL injection vulnerability in Metabase Cloud is being actively exploited in the wild, affecting versions 1.58 and above. The flaw, which lacks a CVE identifier, allows remote attackers to inject SQL into the Metabase application database, gaining administrator access and the ability to steal credentials, read data, and alter configurations. Metabase Cloud instances have been automatically patched, but self-hosted deployments exposing the /api/session/reset_password endpoint remain vulnerable. The attack's blast radius extends to downstream customers: n8n disclosed 136 customer records were stolen (including 25 with plaintext passwords), and AI coding startup Kilo Code confirmed a breach on Aug. 2 that also exposed Slack access tokens. The root cause is Metabase's lack of prepared statements, which is technically challenging given its support for a wide range of SQL databases. Self-hosted users are urged to upgrade immediately or block the vulnerable endpoint, and to rotate all connected database credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Metabase zero-day SQL injection vulnerability and which versions are affected? A maximum-severity SQL injection zero-day (CVSS 10, no CVE yet) affects Metabase versions 1.58 and above. Exploitation targets the /api/session/reset_password API endpoint and allows a remote attacker to inject SQL into the application database, gaining administrator access. From there, attackers can steal stored database credentials, read connected data, change application configuration, and export data. Metabase Cloud instances were automatically patched; self-hosted deployments remain at risk. _Teams running self-hosted Metabase can track patch status and incident updates on daily.dev before their next deployment window._ ### What should I do if I self-host Metabase and cannot patch immediately? Block the /api/session/reset_password endpoint to prevent exploitation if an immediate upgrade is not possible. If the endpoint was already exposed, Metabase recommends revoking all active user sessions, reviewing and deleting any unrecognized API keys, and rotating credentials for every database connected to the platform. Metabase Cloud customers required no action as instances were automatically upgraded to fixed versions. _Developers managing self-hosted analytics infrastructure find incident response guidance like this faster on daily.dev._ ### Which companies were confirmed victims of the Metabase Cloud breach? Two companies publicly disclosed impact. n8n, a workflow automation startup, reported that 136 customer records were accessed containing names and email addresses, with 5 bcrypt-hashed passwords and 25 plaintext passwords exposed. Kilo Code, an AI coding agent startup, confirmed the breach occurred on Aug. 2 over roughly four hours, exposing customer names, emails, and other data, plus Slack access tokens for a subset of users of its Slackbot feature. _When a breach touches your vendors, staying ahead of downstream disclosures matters — developers follow supply chain incidents on daily.dev._ ## Similar posts on daily.dev - [August 2026 Security Vulnerability: What happened?](https://daily.dev/posts/august-2026-security-vulnerability-what-happened--vf4dqe4hg) · Metabase · 6 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#sql](https://daily.dev/tags/sql), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/metabase-sql-zero-day-attacks-could-have-wide-blast-radius-zizravgao) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius","url":"https://daily.dev/posts/metabase-sql-zero-day-attacks-could-have-wide-blast-radius-zizravgao","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/metabase-sql-zero-day-attacks-could-have-wide-blast-radius-zizravgao"},"datePublished":"2026-08-10T21:25:24.469Z","dateModified":"2026-08-12T02:45:25.297Z","description":"A maximum-severity (CVSS 10) zero-day SQL injection vulnerability in Metabase Cloud is being actively exploited in the wild, affecting versions 1.58 and above....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/974aeaff6bedc59e631fb62b5f6e3c42?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/974aeaff6bedc59e631fb62b5f6e3c42?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/metabase-sql-zero-day-attacks-could-have-wide-blast-radius-zizravgao","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,sql,zero-day","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/metabase-sql-zero-day-attacks-could-have-wide-blast-radius-zizravgao#faq","mainEntity":[{"@type":"Question","name":"What is the Metabase zero-day SQL injection vulnerability and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"A maximum-severity SQL injection zero-day (CVSS 10, no CVE yet) affects Metabase versions 1.58 and above. Exploitation targets the /api/session/reset_password API endpoint and allows a remote attacker to inject SQL into the application database, gaining administrator access. From there, attackers can steal stored database credentials, read connected data, change application configuration, and export data. Metabase Cloud instances were automatically patched; self-hosted deployments remain at risk. Teams running self-hosted Metabase can track patch status and incident updates on daily.dev before their next deployment window."}},{"@type":"Question","name":"What should I do if I self-host Metabase and cannot patch immediately?","acceptedAnswer":{"@type":"Answer","text":"Block the /api/session/reset_password endpoint to prevent exploitation if an immediate upgrade is not possible. If the endpoint was already exposed, Metabase recommends revoking all active user sessions, reviewing and deleting any unrecognized API keys, and rotating credentials for every database connected to the platform. Metabase Cloud customers required no action as instances were automatically upgraded to fixed versions. Developers managing self-hosted analytics infrastructure find incident response guidance like this faster on daily.dev."}},{"@type":"Question","name":"Which companies were confirmed victims of the Metabase Cloud breach?","acceptedAnswer":{"@type":"Answer","text":"Two companies publicly disclosed impact. n8n, a workflow automation startup, reported that 136 customer records were accessed containing names and email addresses, with 5 bcrypt-hashed passwords and 25 plaintext passwords exposed. Kilo Code, an AI coding agent startup, confirmed the breach occurred on Aug. 2 over roughly four hours, exposing customer names, emails, and other data, plus Slack access tokens for a subset of users of its Slackbot feature. When a breach touches your vendors, staying ahead of downstream disclosures matters — developers follow supply chain incidents on daily.dev."}}]} ```