A critical zero-day vulnerability impacting **Metabase**'s business intelligence and data visualization software has been actively exploited, prompting an urgent security advisory from the company. The flaw, which currently lacks a **CVE** identifier but carries a **CVSS score of 10.0**, enables unauthenticated remote attackers to execute arbitrary SQL injection within the **Metabase** application database. This severe vulnerability grants attackers complete administrator access to affected instances. With elevated privileges, malicious actors can alter application configurations, steal stored credentials for connected databases, access any data available through those connections, and export sensitive information. **Metabase** confirmed that its cloud instances were targeted, stating, "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above."  ### Immediate Action Required for Self-Hosted Users While **Metabase Cloud** instances have already been updated, self-hosted users must apply security patches immediately. The affected versions are: * `>= x.58.0, < x.58.23` (Fixed in `x.58.24`) * `>= x.59.0, < x.59.20` (Fixed in `x.59.21`) * `>= x.60.0, < x.60.16` (Fixed in `x.60.17`) * `>= x.61.0, < x.61.10` (Fixed in `x.61.11`) * `>= x.62.0, < x.62.8` (Fixed in `x.62.9`) * `>= x.63.0, < x.63.3` (Fixed in `x.63.5`) As a temporary mitigation before patches can be applied, **Metabase** advises blocking the `/api/session/reset_password` endpoint. ### Post-Patching and Compromise Remediation For customers who had their `/api/session/reset_password` endpoint publicly accessible, **Metabase** recommends the following steps after applying the update: * Revoke all active user sessions by deleting rows in the `core_session` table within the **Metabase** Application Database. * Review and delete any unrecognized API keys. * Scrutinize administrator accounts for unexpected changes. * Rotate credentials for all connected databases. * Examine data warehouse logs for signs of unauthorized access. * Review **Metabase** activity and query history for unusual or unauthorized actions. ### Indicators of Compromise (IoCs) While **Metabase** has not disclosed specific details of the attacks, it has provided the following **IoCs** to help identify potential compromises: * A `POST /api/session/reset_password` call with a `400` status code. * Immediately followed by a `GET /api/user/current` call with a `200` status code. **Metabase** CEO **Sameer Al-Sakran** stated, "If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised." ### Notable Victim: Framework One confirmed victim of this zero-day exploit is **Framework**, the modular laptop manufacturer. **Framework** informed its customers that personal data, including names, login **IPs**, addresses, phone numbers, and email addresses, were accessed during the breach. However, no order or payment information was compromised. This incident follows a previous "extremely severe" flaw, **CVE-2023-38646** (**CVSS score: 9.8**), which **Metabase** addressed three years ago. That vulnerability could have led to pre-authenticated remote code execution.