Metabase disclosed a critical zero-day SQL injection vulnerability on August 6, designated CVE-2026-72898, that gives attackers raw SQL access to underlying databases and has already hit multiple companies. The flaw carries a severity score of 10, the highest possible rating on the CVSS scale, and affects Metabase versions 1.58 and up. Several organizations, including Kilo Code, Tally, Framework, n8n, and ChecklyHQ, reported being impacted.
A Perfect Score and an Old School Attack
The vulnerability allows attackers to inject SQL through the /api/session/reset_password endpoint, a path meant for password recovery. David Shipley, CEO of Beauceron Security, said the attack method is "old school and painful" and noted that working proof of concept exploit code exists. "You don't see a perfect 10/10 on CVSS often, but when you do, be worried," Shipley said.
The attack pattern is specific and detectable. It involves a POST /api/session/reset_password request that returns a 400 status code, followed by a GET /api/user/current request that returns a 200 status code. Metabase warned customers about this pattern in its disclosure. "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised," the company said.
Scott Miserendino, CTO at DataBee, called the flaw "a very serious vulnerability." He said it allows attackers to have "unmitigated, raw SQL access" to the Metabase database. From there, attackers can steal or alter account credentials for connected databases, create new admin accounts, change app configurations, escalate privileges, or "degrade, alter or destroy" information.
Broad Reach Across Databases and Deployments
Metabase is an open-source business intelligence tool used for analytics, querying, and visualizing data. It can connect to a wide range of databases, including Databricks, MongoDB, Oracle, Snowflake, Amazon, BigQuery, and others. That broad connectivity means a single compromised instance can expose many backend systems.
The exposure is significant. Shodan, a search engine for internet-connected devices, tracked roughly 2,500 Metabase instances. Wiz, a security company, reported that about 13% of cloud environments have deployed self-hosted Metabase instances. Of those, about 25% are fully accessible on the internet, meaning a quarter of self-hosted deployments are directly reachable by anyone.
Metabase Cloud customers were already upgraded and patched, according to the company. Self-hosted customers may still be vulnerable unless they apply the patch. The company has blocked exploited endpoints, patched the vulnerability, terminated sessions, and revoked credentials.
Miserendino noted that the vulnerability can also affect platforms using OEM versions of Metabase, which are embedded in other products. Affected users may not even know they are affected, he said.
Impacted Companies and What Was Exposed
The list of impacted companies includes Kilo Code, which was recently acquired by Anaconda, Tally, a Y Combinator backed startup building autonomous accounting agents, Framework, a personal computer manufacturer, n8n, a workflow automation platform, and ChecklyHQ, an AI testing and monitoring platform provider.
Threat actors accessed records containing usernames, email addresses, cloud passwords, cryptographic hashes of OpenTelemetry (OTel) API keys, Slack access tokens, and other sensitive information. OTel API keys are used for trace collection in observability systems, and Slack tokens are used for authentication in Slack integrations.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
The impacted companies are contacting customers and taking mitigation actions. Those actions include rotating credentials and API keys, resetting user passwords, invalidating Slackbot authentication tokens, removing compromised admin accounts, and reviewing audit logs.
So far, the impacted companies appear to be smaller organizations and startups, according to the disclosure.
Checkly's Response and a Broader Lesson
Checkly issued a notice about the incident and said it is rethinking internal processes around analytics tools. The company is improving sanitation, performing audits, and paging on-call engineers for future vendor security notices.
"The vulnerability was in a vendor's product, but protecting your data is our job, and this incident put some of it at risk," Checkly said in its notice. The company acknowledged that immediate fixes are not enough. "Rotating credentials fixes the immediate problem. It does not fix the reason this hurt: Our analytics environment held more sensitive data and had broader access than it needed."
Anaconda, which acquired Kilo Code, urged customers to remain diligent. The company said to "be on alert for phishing/social engineering, and maintain credential hygiene (including auditing, reviewing, and rotating credentials regularly) and spam monitoring."
Patching and Mitigation Guidance
Metabase recommends upgrading to the patched version. For example, if an organization is running version 0.58.6, it should move to 0.58.24 or later. A temporary workaround is to block the /api/session/reset_password endpoint.
If the endpoint was publicly accessible, enterprises should take more extensive steps. Metabase advises revoking all active user sessions, reviewing and deleting unrecognized API keys, auditing data warehouse logs and admin accounts, rotating credentials for all connected databases, and reviewing Metabase activity and query histories.
Miserendino offered additional advice for enterprises. He recommends wrapping third-party REST interfaces with their own SQL injection detection, using a web access firewall or reverse proxy. He also said enterprises should monitor their security and database logs for the creation of new or recently elevated administrator accounts, or other unusual activity such as large volumes of data drops.
The disclosure comes amid a busy period for security teams. A related article on a Ruby on Rails critical bug was published on August 4, 2026, just two days before the Metabase disclosure. The Metabase article originally appeared on CSOonline.