Attackers exploited an unauthenticated SQL injection zero-day in Metabase, the popular business intelligence and analytics platform, to breach multiple companies and steal customer data. The vulnerability scores a perfect 10.0 on the CVSS scale and has no CVE assigned yet. It affects self-hosted Metabase instances running version 1.58 and above.
By injecting arbitrary SQL into the Metabase application database, attackers gained full administrative access — enough to change application settings, steal credentials stored for connected databases, and export all underlying data. Framework, the laptop manufacturer, confirmed that customer names, email addresses, login IPs, billing and shipping addresses, phone numbers, and company names were taken. Tally, the online form builder, disclosed that email addresses and password hashes were stolen. LexisNexis was also affected through a third-party vendor running a vulnerable Metabase instance. Metabase’s cloud-hosted product (Metabase Cloud) was not affected; only self-hosted deployments are vulnerable.
How to check if you’re affected
Affected versions are all self-hosted Metabase deployments running versions 1.58 and above that have not yet been patched. Metabase has released fixes across multiple release branches: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Log in to your Metabase admin panel and check the version number under Admin → Settings → About. If your version is not on that patched list, upgrade immediately. In addition, block access to the /api/session/reset_password endpoint at your perimeter (attackers used it as a telltale probe during exploitation), revoke all active user sessions, review API keys and admin accounts for unauthorized changes, rotate credentials for every database Metabase connects to, and inspect query logs for unexpected data exports.