A maximum-severity zero-day with no CVE number has been draining production databases since August 3.
CVSS 10.0. Unauthenticated SQL injection in Metabase, the open-source BI platform thousands of teams use to query their data warehouses. No CVE identifier was ever assigned — so your vulnerability scanner probably never mentioned it.
WHAT ACTUALLY HAPPENED
The flaw sits in a single endpoint: POST /api/session/reset_password. An unauthenticated attacker injects arbitrary SQL into Metabase's own application database, escalates to administrator, then reads the stored credentials for every data source the instance was wired into.
No password spraying. No malware. Just one request to an endpoint that was never meant to accept attacker-controlled SQL.
Metabase confirmed active exploitation of Cloud instances from around August 3, still ongoing on August 8. Versions 1.58 and above are affected.
Framework, the PC manufacturer, confirmed attackers accessed customer names, addresses, phone numbers, emails and IPs; payment data was reportedly untouched. Tally and Kilo Code disclosed exposure too. LexisNexis pulled its Diligence, Metabase API and Newsdesk services offline after unusual activity on third-party-hosted servers.
WHY LOSING A BI TOOL IS WORSE THAN LOSING A SERVER
Metabase is not where your data lives. It is where the keys to your data live — standing connection strings to Postgres, Snowflake, BigQuery, production replicas.
Admin on Metabase means reading everything it ever connected to, with legitimate credentials, from a legitimate host. No lateral movement. No EDR alert. On the warehouse side, it simply looks like analytics.
And with no CVE assigned, any patch pipeline keyed on CVE identifiers had nothing to trigger on.
WHAT TO DO NOW
- PATCH TO YOUR BRANCH'S FIXED BUILD 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9 or 1.63.5; anything on 1.58+ below those is exposed.
BLOCK /api/session/reset_password AT THE PROXY — this is the vendor's own interim mitigation if you cannot patch within the hour.
HUNT THE SIGNATURE — a POST to /api/session/reset_password returning 400, followed by GET /api/user/current returning 200, is the documented compromise pattern; check logs back through your exposure window.
ASSUME THE CREDENTIALS ARE GONE — clear the core_session table, delete unrecognised API keys, audit admin accounts, rotate every database credential Metabase held, and review warehouse query logs.
A CVE number is a convenience for tooling, not a prerequisite for being breached. This one arrived without paperwork and went straight to CVSS 10.
Do you know which production databases your analytics stack can reach right now — and who patched it last?