What Happened
Metabase disclosed a critical zero-day SQL injection vulnerability, tracked as GHSA-vwf4-m7j8-wcjf with a CVSS score of 10.0, that was actively exploited in the wild before the company issued a fix. The flaw exists in the publicly reachable POST /api/session/reset_password endpoint. An unauthenticated attacker who reaches this endpoint injects arbitrary SQL statements directly into the Metabase application database, seizing full administrator access without any credentials.
Every Metabase release from version 1.58 onward is affected, spanning branches 0.58 through 0.63. Metabase detected the abuse after its own Metabase Cloud platform was breached on August 3. The company blocked the vulnerable endpoint and shipped a patch within hours. All Metabase Cloud customers received the fix automatically. Self-hosted deployments remain exposed until administrators apply the patch manually.
At least two organizations confirmed data theft tied to this zero-day before the patch was applied: hardware company Framework and accounting software firm Tally, both of which disclosed unauthorized access to customer records including names, addresses, phone numbers, and email addresses. Additional victims are expected as disclosure timelines unfold.
Why This Matters for Canadian Organizations
Metabase is among the most widely deployed open-source business intelligence tools, used by data teams in startups, mid-market companies, SaaS providers, and government technology groups across Canada. Organizations running self-hosted Metabase instances on versions 0.58 through 0.63 are exposed until they act.
The risk is not abstract. Metabase instances typically connect directly to production databases containing customer records, financial data, and operational metrics. An attacker with administrator access to Metabase gets read access to all the data sources configured within it. Depending on the database permissions in use, write and delete access are also within reach.
For Canadian organizations subject to PIPEDA, a compromised Metabase instance is a reportable breach scenario. The data accessible through a Metabase admin account almost certainly qualifies as personal information under the Act. Organizations handling health records or financial data face additional notification obligations at the provincial level and under sector-specific frameworks like OSFI Guideline B-13.
OSFI-regulated institutions running Metabase for reporting or analytics should assess their deployment against this zero-day as a Guideline B-13 incident scenario. The relevant question is not whether your Metabase instance holds sensitive data — it almost certainly does — but whether the patch has been applied and whether access logs show exploitation activity since August 3.
What to Do
If your organization runs a self-hosted Metabase deployment on any version from 0.58 through 0.63, update to the latest patched release immediately. Do not wait for a scheduled maintenance window.
Review your web server and application logs for POST requests to /api/session/reset_password going back to August 3. Audit the databases and data sources connected to your Metabase instance to determine what an attacker with administrator access would have been able to access during the exposure window.
If your Metabase instance was running in the affected version range and received traffic during the exposure window, engage your incident response team and assess PIPEDA breach notification obligations.
If you are on Metabase Cloud, no action is required — the patch was applied automatically. Confirm your deployment type with your data infrastructure team if there is any uncertainty.
Vulnerability details are available from SecurityWeek.
