Exploited Metabase zero-day gives unauthenticated attackers admin and database credentials

Metabase warned that a critical zero-day in its open-source business intelligence platform was exploited in the wild for data theft. Scored 10.0 and tracked only as GHSA-vwf4-m7j8-wcjf with no CVE assigned, so scanners relying on the national database will not flag it, the flaw is an unauthenticated SQL injection in the password-reset endpoint. A remote attacker with no credentials injects SQL into the application database, gains administrator access, and can steal the stored credentials for every database the instance connects to, then read and export their data. Metabase Cloud was attacked from around August 3 and is already patched; self-hosted versions 1.58 and later must upgrade.

Check

Upgrade self-hosted Metabase to the fixed release for your branch immediately, and if the reset-password endpoint was internet-reachable, treat the instance and all connected database credentials as compromised.

Affected

Organizations running self-hosted Metabase 1.58 or later; an unauthenticated attacker can gain admin access and steal credentials for every connected database, and it is exploited with no CVE for scanners to catch.

Fix

Patch to the safe release, clear the session table to revoke sessions, rotate credentials for all connected databases, audit API keys and admin accounts, and block the reset-password endpoint if unpatched.