Attackers are actively exploiting a previously unknown SQL injection flaw in Metabase, the widely used open source business intelligence dashboard, and working exploit code is now circulating in public. Anyone running a self-hosted Metabase server needs to patch it today.
Metabase disclosed the incident on 6 August 2026, saying an attacker had used a zero-day SQL injection vulnerability, tracked as GHSA-vwf4-m7j8-wcjf, against Metabase Cloud. SQL injection means an attacker can smuggle their own database commands into a request the application trusts. Over the following days several companies published their own notices: Framework and Tally on 7 August, n8n on 8 August, and Kilo Code (Anaconda) on 9 August.
Researchers at Wiz, in a technical write-up by Rami McCarthy, said that as of noon UTC on 10 August they had observed public proof-of-concept exploits being open sourced. Wiz is withholding its own full exploit to avoid enabling further attacks.
What's affected
The flaw sits behind Metabase's /api/session/reset_password endpoint and has been present since version 1.58, when the auth_identity module was refactored. With the hosted service fixed, self-hosted deployments are the exposure that matters. Wiz observed that roughly 13% of cloud environments have self-hosted Metabase instances deployed, and that approximately 25% of those instances are fully internet accessible. Shodan inventories around 2,500 Metabase instances.
How the attack works
Wiz reconstructed the bug by comparing the vulnerable and patched builds and decompiling the relevant Clojure code, a job the team ran with an AI agent. The patched code adds a single check: that a user-id value is a positive integer before it is used in a query. That is the giveaway, because user-id is not a documented parameter of the password reset endpoint at all, which only expects a token and a password.
Three ordinary language and framework behaviours line up to make it exploitable. Clojure's merge function combines two maps without stripping extra keys, so when authentication fails an attacker-supplied user-id from the original request survives untouched. JSON parsing turns that attacker key into a Clojure keyword, so a payload that sets user-id to a nested raw value arrives as structured data rather than a string. HoneySQL, the query builder underneath, treats a raw value as a licence to embed a literal SQL string, bypassing the parameterisation that normally blocks injection outright. The value then reaches the database lookup and the result is arbitrary blind SQL injection. The exact payload depends on the backing database, which is H2 by default but PostgreSQL, MySQL or MariaDB in most production deployments.
What you should do
Upgrade self-hosted Metabase to a fixed release now. Checking /api/session/properties will tell you which version an instance is running, and Metabase's own security update carries the immediate steps for exposed deployments. Because the vulnerable endpoint is reachable before login, restricting who can reach a Metabase instance over the network is worth doing at the same time. Wiz also generated static analysis rules and used them to hunt for unpatched variants of the same pattern, reviewing every merge on a request object and every auth-identity login call site in the project.
The sequence here is a familiar one: a quiet vendor fix, a short gap, then public exploit code and a wave of scanning, much as followed the Ivanti Sentry flaw. Injection bugs in internet facing web apps also remain a reliable opening move for opportunistic crews, as in the case where attackers used a SQL injection flaw to hijack a server and mine cryptocurrency.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.