Our S.O.S. line:
+49 89 262 025954
Our team of experts is ready to assist your organization in the event of a cyberattack.
details
The exploit utilizes one of the oldest tool in the hackers’ toolbox: #SQLi. In the popular Open-source Business Intelligence tool, Metabase. Metabase enables users to query databases, create visualizations and build dashboard without writing any SQL code with the help of a powerful Query Builder tool.
Adversaries found and created a PoC for a vulnerability within the public API endpoint what is handling password reset requests. The exploit utilizes a bug within the POST request for /api/session/reset_password. As the endpoint is publicly accessible to handle locked-out users, it handles requests without session authentication check, doing so exposes the backend to attackers.
This faulty behavior can be exploited with a specially crafted HTTP request. The malicious SQL payload can be passed for evaluation to the Metabase application database engine because of improper sanitization. This injection allows the actor to run queries to alter user records without possessing any user information or session token.
This vulnerability affects both the Community (Open Source) and Enterprise/Pro version of Metabase. As of now the exploit was fixed on all branches. This shows us once more, the importance of proper SQL (and any) input sanitizations, and why we should keep all of our software up to date. Even if an exploit is out in the wild, it is usually patched within days.
There are multiple companies confirming breaches using this exploit, some of them are Framework, Tally, n8n, Kilo Code, and ChecklyHQ. How can you defend against this threat? If you are using Metabase Cloud you are already secure, but if you are selfhosting, please check the following list for vulnerable versions:
Official changelogs:
https://www.metabase.com/changelog
More details about the incident:
https://www.techtimes.com/articles/324060/20260812/metabase-sql-injection-breached-five-companies-exposed-all-connected-database-credentials.htm
https://cybernews.com/security/shinyhunters-metabase-hack-zero-day/
Do you want to be protected from attacks like the above? See our defensive services here: Managed Security – White Hat IT Security
This week’s CVE of the Week is CVE-2026-24301, also known as CoSnitch, an exfiltration method in Microsoft Copilot that could allow an unauthorized attacker to steal sensitive information and data. With a CVSS score of 8.8, deserves serious attention. It [...]
