A severe unauthenticated SQL injection vulnerability in Metabase has been exploited by attackers for maximum privileges and credential theft across connected databases since August 3, 2026 This article explores vulnerability metabase exploited. . This zero-day attack allows remote attackers to inject arbitrary SQL into the application database without any credentials, enabling full system access and credential theft across all connected databases.
Reported victims included Framework and Tally customers, where unauthorized access exposed customer details such as names, emails, addresses, phone numbers, and company information. Defenders should monitor application and ingress logs for a distinctive two-step pattern that indicates potential exploitation: a POST request to /api/session/reset_password returning a 400 status code followed by a GET request to /api/user/current returning a 200 status code.
If the reset_password endpoint is publicly accessible, all active sessions should be revoked by clearing the core_session table, auditing API keys, and removing any unrecognized entries; review administrator accounts for unusual changes. This incident aligns with MITRE ATT&CK techniques such as Exploit Public-Facing Application, Account Manipulation, and Trusted Relationship abuse, highlighting the significant risk posed by unauthenticated endpoints on internet-facing BI platforms.
