Metabase Warns of Maximum-Severity Zero-Day SQL Injection Exploited in the Wild

Metabase has disclosed that a maximum-severity vulnerability (CVSS 10.0) in its business intelligence and data visualization software is being actively exploited in the wild as a zero-day, according to a report from The Hacker News. The flaw does not currently carry a CVE identifier. It allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can lead to admin-level access without any prior authentication.

Why It Matters

Metabase is widely deployed for internal analytics and dashboarding, often with access to sensitive business data and, depending on configuration, connections to production or downstream databases. An unauthenticated SQL injection that leads to full admin access is about as severe as a web application flaw gets — it requires no credentials, no user interaction, and can expose or corrupt any data the Metabase instance can reach. Organizations running self-hosted or internet-exposed Metabase instances are at immediate risk, particularly since active exploitation has already been reported.

What Defenders Should Do Now

• Identify all Metabase instances in your environment, especially any exposed to the internet, and check installed versions against Metabase's advisories and patch releases as they become available.
• If a fix isn't yet available or hasn't been applied, consider restricting access to Metabase behind a VPN, firewall rules, or authentication proxy until patched.
• Review Metabase application and database logs for anomalous or malformed query patterns, unexpected administrative account creation, or new admin sessions from unfamiliar source IPs.
• Monitor the underlying application database for unusual query activity, schema changes, or new user/API-key creation events tied to the Metabase service account.
• Watch outbound network activity from Metabase hosts for signs of post-exploitation (e.g., data exfiltration or lateral movement) given the admin-level access this flaw can grant.

This is developing, net-new intelligence — no CVE identifier or full technical details have been published yet, and specifics such as affected version ranges and a fix timeline were not included in the initial report. We will track this story as more information emerges. For the original report, see The Hacker News.