# Metabase Zero-Day Flaw Threatens Data Security Across Multiple Platforms

*Published August 12, 2026*
*Source: [https://www.darkreading.com/vulnerabilities-threats/metabase-sql-zero-day-attacks-wide-blast-radius](https://www.darkreading.com/vulnerabilities-threats/metabase-sql-zero-day-attacks-wide-blast-radius)*

## Executive Summary

A zero-day SQL-injection vulnerability in Metabase Cloud has been exploited, risking data breaches for many organizations. While Metabase Cloud customers have been patched, self-hosted instances remain vulnerable if they have exposed specific endpoints.

## Article

A critical security gap in Metabase Cloud has been actively exploited, endangering numerous downstream organizations. This zero-day SQL-injection vulnerability, uncovered in versions 1.58 and higher of Metabase's platform, allows unauthorized access to administrator controls via SQL statements, potentially leading to significant data breaches. Metabase CEO Sameer Al-Sakran assured users that immediate measures were taken to block the compromised endpoints and patch the vulnerability. Although the vulnerability lacks a CVE identifier, it has been given a maximum-severity CVSS score of 10, highlighting the grave risk it poses. The flaw enables attackers to alter application settings, steal credentials, access data, and export sensitive information. While Metabase Cloud customers have been automatically updated to a secure version, those with self-hosted instances remain at risk if they have publicly exposed the /api/session/reset_password endpoint. The exact scope of affected customers is unclear, and the vulnerability's reach may extend beyond Metabase Cloud to self-hosted setups. Johannes Ullrich of the SANS Internet Storm Center emphasized the importance of endpoint security, noting that many users likely have their instances exposed, which facilitates exploitation. This incident underscores the persistent challenge of SQL-injection vulnerabilities, a common issue in software security. The flaw is attributed to Metabase's failure to use prepared statements, complicating support for diverse databases. The breach has already impacted several startups, including n8n and Kilo Code, resulting in unauthorized access to customer data. Metabase has urged self-hosted customers to update their software immediately or block the vulnerable endpoint to mitigate risks. Additionally, incident response steps such as revoking user sessions, reviewing API keys, and rotating database credentials are recommended for those with exposed endpoints.