Metabase Zero-Day Rated CVSS 10 — Check If Your Reporting Tool Is Exposed

Metabase, the open-source analytics platform used by tens of thousands of organisations worldwide, has disclosed a critical SQL injection vulnerability that attackers exploited as a zero-day to steal customer data. The flaw carries the maximum CVSS score of 10.0.

The attack hit both Metabase Cloud and self-hosted instances running version 1.58 and above. Laptop maker Framework, form builder Tally, and legal research firm LexisNexis have all confirmed they were affected. Attackers used the flaw to gain admin access, steal stored database credentials, and export data — all without needing to log in.

Why this matters for Australian businesses: Metabase is one of those tools that often flies under IT’s radar. We regularly see it in Australian client environments — spun up by a marketing manager who needed dashboards, or a developer who wanted quick reporting. It’s usually connected directly to production databases with broad read access, and nobody on the security side knows it’s there. If that sounds familiar, you need to check now.

What to do: Ask your team (or your IT provider) whether Metabase is running anywhere in your environment. If it is, update to the patched version immediately — 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5, depending on your branch. If you can’t patch right away, block access to the /api/session/reset_password endpoint. Then rotate all database credentials connected to Metabase and review your logs for any POST requests to that endpoint returning a 400 status code followed by a successful GET to /api/user/current — that pattern indicates compromise.

If you’re not sure what analytics tools are running in your environment, get in touch. Shadow IT is one of the easiest attack surfaces to miss — and one of the most dangerous when it’s connected to your databases.