A severe zero-day vulnerability has been identified in Metabase, an open-source business intelligence platform, which has been actively exploited in the wild. This flaw, tracked as GHSA-vwf4-m7j8-wcjf and carrying a maximum CVSS score of 10.0, allows attackers to gain full administrator access to Metabase instances without authentication. The vulnerability affects all versions from 1.58 onwards, specifically through the publicly accessible POST /api/session/reset_password endpoint, which is susceptible to SQL injection attacks.
Once exploited, attackers can alter settings, extract credentials, and access sensitive data across connected databases. The vulnerability came to light after a breach of Metabase's Cloud SaaS platform on August 3, prompting the company to block malicious endpoints and issue a quick patch to protect its cloud customers. However, self-hosted Metabase instances remain at risk until administrators apply the necessary updates.
Notably, companies like Framework and Tally have already reported unauthorized access to customer data, including names, addresses, and emails, linked to this vulnerability. Administrators of self-hosted Metabase should upgrade immediately to the latest patched release applicable to their version branch to prevent exploitation.
Security teams should also investigate web server and application logs for signs of compromise, indicated by a specific attack pattern involving POST and GET requests. Moreover, it is essential to revoke active sessions, audit API keys, review administrator accounts, rotate credentials, and analyze logs for unauthorized activities if the vulnerable endpoint was previously exposed.