Metabase Warns of Zero-Day Exploited in the Wild, Allowing Privilege Escalation to Administrator

432/69 Monday, August 10, 2026 Metabase has issued a security advisory for a critical vulnerability affecting its Business Intelligence and Data Visualization platform after discovering that the flaw had been actively exploited as a zero-day. The vulnerability carries a CVSS score of 10.0 and had not yet been assigned a CVE identifier at the time of reporting. It affects certain versions of self-hosted Metabase deployments, while Metabase Cloud has already been patched. According to the report, the vulnerability allows an unauthenticated attacker to perform SQL injection against Metabase’s application database and escalate privileges to gain administrator access to an affected Metabase instance. Once administrative privileges are obtained, an attacker could modify system configurations, steal credentials for connected databases, access data through existing database connections, and exfiltrate information from the environment. Administrators operating self-hosted Metabase instances are advised to urgently upgrade to the patched versions corresponding to their current release branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5. If an immediate upgrade is not possible, administrators should temporarily block access to the /api/session/reset_password endpoint. After applying the update, organizations should revoke all active user sessions, review API keys and administrator accounts for suspicious activity, rotate credentials for connected databases, and examine data warehouse logs, Metabase activity logs, and query history for signs of unauthorized activity or data access. Source https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html