Critical Metabase SQL Injection Zero-Day Hits CISA's KEV Catalog After Breaching Framework and n8n

Overview

Metabase, a widely used business intelligence and dashboarding tool, disclosed a maximum-severity SQL injection vulnerability on August 6, 2026, after attackers exploited it as a zero-day against Metabase Cloud customers. The flaw, tracked as CVE-2026-72898 with a CVSS score of 10.0, let an unauthenticated remote attacker inject arbitrary SQL through the application’s password-reset endpoint and gain administrator access to an instance, according to Metabase’s security advisory. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply the fixes by August 14, 2026, according to The Hacker News.

What We Know

Metabase said attackers “utilized an unknown (‘0-day’) security vulnerability in versions 1.58 and above” to attack Metabase Cloud, according to Metabase’s security update. The company patched the issue on August 6 across all six actively maintained release lines — the 1.58 branch, for instance, was fixed in version 1.58.24 — and published a detection pattern for administrators: a POST request to /api/session/reset_password returning a 400 status code, immediately followed by a GET request to /api/user/current returning 200, according to Metabase.

Security firm Wiz reverse-engineered the flaw and published a technical breakdown on August 10, tracing the root cause to how Metabase’s Clojure-based backend handles request data. Wiz found that Metabase’s merge function “combines two maps, with the second map’s values overwriting the first’s” without stripping unexpected keys, meaning an extra parameter smuggled into a request could survive into application logic and ultimately reach HoneySQL’s :raw keyword, “a feature that allows embedding literal SQL strings, bypassing parameterization,” according to Wiz. Wiz estimated that roughly 13% of cloud environments run self-hosted Metabase instances, with about 25% of those fully accessible from the internet, according to Wiz.

At least five companies have published incident notices tied to the exploitation, according to Wiz’s disclosure timeline. Laptop maker Framework told customers that “customer names, login IPs, addresses, phone numbers, and emails were accessed during the hack,” and that no order or payment information was taken, according to The Hacker News. Workflow-automation company n8n said an unauthorized party accessed 136 customer records, five of which contained bcrypt-hashed n8n Cloud passwords, according to The Hacker News. Anaconda, which recently acquired the AI coding tool Kilo Code, said a roughly four-hour attack on August 2 exposed names, email addresses and other data for a subset of Kilo Code users, and exposed Slack access tokens tied to the product’s Slack integration, according to Anaconda. Checkly, whose Metabase Cloud instance was queried by the attacker for about 26 minutes on August 3, said credentials stored as Checkly secrets “are encrypted at rest and injected only at run time” and were not exposed in plaintext, according to Checkly.

On August 12, Metabase chief executive Sameer Al-Sakran published a follow-up announcement crediting security firms DOS and Ophion Security, as well as Anthropic, “for helping identify areas of focus” in a further round of hardening beyond the initial patch, and said the company would shift to “weekly minor releases” focused on security and observability rather than new features, according to Metabase.

What We Don’t Know

Metabase and the researchers who have published findings so far have not disclosed who is behind the attacks, how the attacker originally discovered the vulnerability, or how many organizations beyond those that have issued public notices were affected.