Metabase has disclosed that its Cloud SaaS platform was attacked through an unknown zero-day SQL injection vulnerability that had no CVE identifier assigned and carried a maximum-severity CVSS score of 10.0. The company confirmed active exploitation and said customer data at laptop maker Framework, online form builder Tally, and information services firm LexisNexis was accessed before fixes were released.
How the Unauthenticated SQL Injection Grants Administrator Access
Metabase said the flaw affects versions 1.58 and above and lets a remote attacker inject arbitrary SQL into the application database without authentication. According to the vendor’s notification, successful exploitation hands an attacker administrator access, which can then be used to change application configuration, steal stored credentials for connected databases, read any data reachable through those connections, and export records at will.
CVSS 10.0 Zero-Day With No CVE Identifier Reaching Connected Databases
The absence of a CVE registration makes the disclosure unusual. Metabase’s advisory leans on the concrete evidence instead: anomalous log activity that the company tied to compromise of customer instances. The practical consequence is that detection for many administrators depends on reviewing the published indicator of compromise rather than searching public vulnerability databases.
Reset-Password Endpoint Workaround and the Stated Compromise Indicator
Metabase urged self-hosted administrators to block the /api/session/reset_password endpoint until patches are installed. CEO Sameer Al-Sakran described the forensic fingerprint as a POST to /api/session/reset_password returning HTTP 400, followed by a GET to /api/user/current returning 200. Under that pattern, Al-Sakran wrote, it is “likely that your instance has been compromised.”
Data Theft Confirms at Framework, Tally, and LexisNexis
The exploitation surfaced at three named customers. Framework said the attackers obtained customer names, login IPs, billing and shipping addresses, phone numbers, emails, and company names, while stating that no order or payment data was taken. Tally said its Metabase analytics environment was compromised on August 3 and that email addresses and password hashes were exposed, with forms and answers stored separately and not reached. LexisNexis alerted customers that its Metabase API had been impacted through a third-party vendor, disconnected the affected systems, and said it was unclear whether customer data was exposed.
Framework Exposure: Customer Names, Login IPs, and Shipping Addresses
For Framework, the data set maps almost directly to an e-commerce order flow: contact details, addresses, and device identifiers rather than payment information. The laptop maker’s account of what did not leak, and the precision of the list, suggests the attacker pulled stored profile records from the connected analytics database.
Tally Password Hashes and the Separately Stored Form Data
Tally’s disclosure draws a boundary that matters for users: credential hashes sat within the compromised Metabase environment, while the content customers actually created in forms lived elsewhere. The separation is what distinguishes this incident for Tally from a fuller account takeover scenario.
LexisNexis Third-Party Exposure and Disconnected Systems
LexisNexis acknowledged the impact came through a vendor rather than its own infrastructure. The company did not confirm whether customer data was exposed, a gap that leaves affected users without certainty about what a third-party Metabase instance contained.
Patching All Branch Lines and the Memory of CVE-2023-38646
Metabase shipped fixes across every supported branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Cloud customers were updated automatically; self-hosted users had to patch manually, revoke active sessions, review API keys and administrator accounts, rotate connected-database credentials, and inspect logs for the disclosed pattern.
Patch Versions for Branches 0.58 Through 0.63 and Cloud Coverage
The affected and fixed version pairs run from 0.58.0 through 0.58.23 and 0.59.0 through 0.59.19, 0.60.0 through 0.60.15, 0.61.0 through 0.61.9, 0.62.0 through 0.62.7, and 0.63.0 through 0.63.2, with fixes at 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 respectively. Organizations still on older branches had to confirm which fixed line applied to their deployment.
CVE-2023-38646 and the Recurring Flaw Class in Metabase
The episode echoes Metabase’s handling of CVE-2023-38646, a pre-authentication remote code execution flaw with a CVSS score of 9.8 that the company corrected on this same class of defect. That a data-visualization platform used to reach production databases has now carried two serious flaws of the same general shape argues for treating connected-database credentials as a primary exposure whenever such a service is patched, rather than waiting for a CVE record or a public exploit demonstration. For security teams running self-hosted business-intelligence software, the incident also sharpens the value of log review as a first line of detection when no advisory identifier exists to anchor a search.
