A critical unauthenticated SQL injection zero-day (CVSS 10.0) in Metabase versions 1.58 and above was actively exploited to steal customer data. Attackers gained administrator access to compromised instances, enabling credential theft, data exfiltration, and configuration changes. Metabase Cloud customers have been patched automatically; self-hosted users must manually upgrade to safe releases (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5). Confirmed victims include laptop maker Framework (names, emails, addresses, phone numbers stolen), form builder Tally (emails and hashed passwords exposed), and LexisNexis (Metabase API disrupted via a third-party vendor). Organizations unable to patch immediately should block the `/api/session/reset_password` endpoint and follow Metabase's remediation checklist including session revocation, credential rotation, and log review.
Questions this post answers
What Metabase versions are affected by the SQL injection zero-day and what are the patched versions?
The unauthenticated SQL injection zero-day affects Metabase versions 1.58 and above (all branches from 0.58 through 0.63). The minimum safe patched releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Metabase Cloud customers were patched automatically; self-hosted installations require a manual upgrade. Teams running self-hosted Metabase track patch releases and advisories like this one on daily.dev.
How can I tell if my self-hosted Metabase instance was compromised by the SQLi zero-day attack?
Compromise can be identified by a POST request to `/api/session/reset_password` returning a 400 status code, followed by a successful GET request to `/api/user/current`. Metabase warns that system logs showing this sequence indicate the instance was likely breached. Recommended follow-up steps include revoking all active sessions, reviewing API keys and admin accounts, rotating database credentials, and inspecting query history. Defenders investigating Metabase incidents find the latest IoCs and remediation guidance on daily.dev.
What data was stolen from Framework in the Metabase zero-day breach?
Attackers who compromised Framework's Metabase instance stole full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers, and company names. Framework for Business customers may also have had company name, phone number, VAT, EIN, and billing email address exposed. Framework was notified by Metabase on August 6 that its instance had been accessed on August 3. Developers and security teams handling breach notifications stay current on incidents like this through daily.dev.