News Date: 2026-08-07
A critical vulnerability in the Metabase business intelligence platform has demonstrated how an analytics application can become a direct route into sensitive corporate data. The unauthenticated SQL injection flaw was exploited before a fix was available and carries the maximum CVSS severity score of 10.0.
From Password Reset to Administrative Control
The vulnerable component is associated with the Metabase password-reset interface. A remote attacker could inject SQL into the application database, ultimately gaining administrator-level access to a targeted Metabase instance. That access could allow the intruder to modify configuration settings, obtain stored database credentials, run queries against connected systems and export information.
Framework confirmed that attackers accessed customer records through its Metabase environment. The exposed information may include names, email addresses, telephone numbers, login IP addresses and billing or shipping details. Tally also reported that email addresses and cryptographic password hashes were taken, although its form submissions were stored separately and were not affected.
Metabase Cloud customers have already received the vendor's fix. Self-hosted customers must update manually to at least versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5, depending on the branch they operate.
What Administrators Should Do
- Install a corrected release immediately.
- Revoke active sessions and review administrator accounts.
- Rotate credentials used to connect Metabase to business databases.
- Audit API keys, query history and exported information.
- Temporarily block the affected password-reset endpoint if patching cannot be completed immediately.
Metabase has also identified a useful compromise indicator: a failed POST request to the password-reset endpoint followed by a successful request for current-user information. Organizations finding that sequence should treat the installation as potentially breached rather than merely vulnerable.
Analytics Platforms Need Production-Grade Security
In my view, the most important lesson is that analytics systems should not be treated as harmless reporting tools. They often hold credentials that unlock multiple databases and can aggregate information that would otherwise remain separated. Security teams should place them inside tightly controlled network zones, restrict administrative access and monitor unusual query or export activity.
Patching closes the vulnerability, but it does not remove access already obtained by an attacker. A complete response must therefore combine upgrading with credential rotation, session invalidation and a detailed investigation of connected data sources.