Inside the Metabase SQLi: Exploited in the Wild

A zero-day SQL injection vulnerability in Metabase, tracked as GHSA-vwf4-m7j8-wcjf, has been exploited in the wild against Metabase Cloud and potentially self-hosted instances. The vulnerability exists in versions 1.58 and later, where an attacker can inject malicious SQL by including a 'user-id' parameter with a 'raw' SQL payload in the /api/session/reset_password endpoint. The flaw stems from improper handling of JSON input, merging of unvalidated user input, and unsafe use of HoneySQL's :raw directive, leading to arbitrary blind SQL injection. Wiz Research reverse-engineered the vulnerability after the patch was not publicly disclosed, and observed public proof-of-concept exploits as of August 10, 2026.

AI-extracted · verify before operational use