Metabase Zero-Day Breach Exposes Admin Access and Sensitive Data

Metabase has disclosed that its cloud analytics platform was breached through a previously unknown critical vulnerability, which attackers exploited to gain administrator access and potentially steal sensitive data from connected databases. The company confirmed the zero-day attack on August 8, 2026, stating that the flaw, carrying a maximum CVSS score of 10.0, allowed unauthenticated attackers to inject arbitrary SQL into the Metabase application database. The vulnerability affects versions 0.58 through 0.63 of the software.

According to the company's advisory, the attack targeted Metabase Cloud before the flaw was identified. "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown 0day security vulnerability in versions 1.58 and above," the advisory stated. Metabase said it immediately blocked the endpoints used in the attack and deployed a patch. Cloud instances have already been updated to secure versions.

The vulnerability resides in the password reset API endpoint. An attacker could send a crafted request to this endpoint, inject SQL, and gain full administrative control over a Metabase instance. With that access, they could alter...