Metabase Zero-Day: CVSS 10 Exploited in the Wild

A maximum-severity vulnerability in Metabase — the open-source business intelligence and data visualization platform — is being exploited in the wild before a CVE has been assigned or a vendor security bulletin published. The Hacker News reported on August 8 that Metabase confirmed active exploitation and issued a warning to users; as of this writing, Metabase has not published a standalone security advisory URL, and no CVE identifier exists yet.

What the Vulnerability Does

Per The Hacker News’s reporting citing Metabase’s own warning: an unauthenticated remote attacker can inject arbitrary SQL directly into the Metabase application database, escalating to full administrative access — your data, your credentials, every connected data source.

THN cites a CVSS score of 10.0 for this flaw. That figure has not been independently confirmed against an NVD entry or official Metabase security bulletin, because neither exists yet. Take it as the vendor-acknowledged characterization pending formal assignment.

Affected version ranges have not been published as of this writing.

Who’s at Risk

Metabase runs in production at banks, hospitals, and tech companies, typically sitting in front of databases holding real production data. Self-hosted instances with internet exposure are the obvious target, but network-adjacent instances — reachable from any segment that could be compromised — are in scope too.

Metabase Cloud (the managed SaaS tier) is infrastructure Metabase controls directly. If you’re on cloud-hosted Metabase, confirm with their support that your instance is protected.

What to Do Right Now

In order of impact:

1. Remove your Metabase instance from public internet access if it doesn’t strictly need to be there. Network isolation is the highest-leverage move before a patch lands.
2. Monitor Metabase’s release channels for a patched version. Watch their official announcements and GitHub releases for version guidance as it emerges.
3. Review admin access logs for unexpected sessions or unusual activity from August 8 onward.
4. Audit database connections. Know exactly what data sources your Metabase instance can reach — those are all in scope if an attacker gets admin access.

This Pattern Again

Zero-day in a widely-deployed internal analytics tool, exploitation before CVE assignment, organizations caught off-guard because the tool isn’t directly internet-facing — until someone finds a path to it anyway. We’ve documented the same sequence with Kemp LoadMaster’s command injection that hit CISA KEV with 792 confirmed exploit attempts and Langflow’s unauthenticated RCE. Internal tooling gets patched on a slower cycle than perimeter gear. Attackers know that.

This story is developing. We’ll update when Metabase publishes an official advisory, a CVE is assigned, or affected version ranges are confirmed. Primary source: The Hacker News.

Track active exploitation additions on our KEV tracker.