Overview
- Metabase disclosed the incident on Thursday and said it blocked the abused endpoints and pushed point fixes for Cloud and fixed releases for self‑hosted versions.
- The flaw let unauthenticated attackers inject arbitrary SQL into Metabase’s application database and gain administrator control of an instance, which can expose stored credentials and any connected data sources.
- Several Metabase Cloud customers including Framework, Tally, n8n, and Kilo Code/Anaconda reported that attackers accessed or exfiltrated customer records such as names, emails, IP addresses, password hashes, and access tokens.
- Wiz Research reverse‑engineered the bug and traced the root cause to an undocumented user‑id surviving a request merge and HoneySQL’s :raw semantics enabling unparameterized SQL; Wiz reported public proof‑of‑concept exploits appearing on August 10.
- Metabase urged immediate upgrades or, where that’s not possible, to block POST /api/session/reset_password, revoke sessions, rotate credentials, review logs for the POST 400 then GET 200 indicator, and search connected data warehouses for unauthorized access.