Metabase patches CVSS 10 zero-day as n8n, Framework and Kilo Code report data theft
An unauthenticated SQL injection in a password-reset endpoint shows why analytics tools holding database credentials need production-grade hardening.
Metabase, the open-source business intelligence and dashboard tool, disclosed on 8 August that a maximum-severity flaw in its software had been exploited as a zero-day before a fix was available. The bug, tracked as CVE-2026-72898 and rated CVSS 10.0, is an SQL injection in the /api/session/reset_password endpoint. An attacker with no credentials can send crafted requests that run arbitrary SQL against Metabase's own application database, which is enough to obtain an administrator session. From there, the intruder can alter configuration, read stored credentials for every connected data warehouse, run queries and export results.
Affected releases span the 1.58 through 1.63 lines; fixed builds are 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9 and 1.63.5. The Hacker News reported that roughly 2,500 instances are reachable from the internet and that Metabase Cloud itself was among the targets. CISA has added the CVE to its Known Exploited Vulnerabilities catalogue, giving US federal agencies until 14 August to patch.
Several downstream companies have confirmed impact. Workflow automation vendor n8n said an attacker used the flaw on 2 August to obtain 136 customer records containing names and email addresses; five of those records included bcrypt-hashed passwords for n8n Cloud accounts. n8n also disclosed that a separate bug fixed in April 2023 had once stored a small number of Cloud passwords in plain text, and said it had contacted all 25 affected account holders as a precaution. Laptop maker Framework reported that customer names, IP addresses, postal addresses, phone numbers and email addresses were accessed, and developer-tool company Kilo Code said Slack access tokens for a small subset of users were exposed.
Metabase published indicators of compromise: a POST to the reset-password endpoint returning HTTP 400, followed by a GET to /api/user/current returning 200. Recommended actions include blocking the endpoint until patched, deleting rows from the core_session table to revoke sessions, reviewing API keys and admin accounts, rotating connected database credentials and checking warehouse activity logs.
Why it matters
Analytics tools sit in an awkward place: they are often treated as internal conveniences, yet they hold read credentials for the most valuable databases in a company. This incident shows that a single unauthenticated endpoint in such a tool can become the shortest path to customer data across many unrelated organisations at once. The pattern of one vendor's flaw surfacing as a string of separate breach notices is becoming the normal shape of supply-chain exposure. Expect more scrutiny of what "internal" tools can reach, and faster patch deadlines when exploitation is confirmed before a fix exists.
Analytics tools sit in an awkward place: they are often treated as internal conveniences, yet they hold read credentials for the most valuable databases in a company.
Crafted POST to /api/session/reset_password
No login needed; injected SQL runs against the Metabase application database
Administrator session obtained
Attacker can now call authenticated APIs such as /api/user/current
Configuration and stored credentials read
Connection secrets for every linked data warehouse are exposed
Queries run and data exported
Customer records leave via normal dashboard and export features
What you can learn from this
SQL injection still works when input reaches a query unparameterised. An injection flaw happens when text supplied by a user is concatenated into a database statement, so the database cannot tell where the query ends and the data begins. Parameterised queries fix this by sending the statement and the values separately, letting the driver bind values as data no matter what characters they contain. The reset-password path here is a reminder that unauthenticated endpoints deserve the strictest input handling, because they are reachable by anyone who can see the port.
Application databases are a credential store in disguise. Tools like Metabase keep their own metadata database that records users, sessions and, crucially, connection details and secrets for the warehouses they query. Anyone who can write to that database can mint a session or promote an account, and anyone who can read it can lift the downstream credentials. That is why the recommended response goes beyond patching to rotating every connected database password: the application database is effectively a key ring.
Session revocation is a database operation, not a logout button. Web applications usually store server-side sessions in a table keyed by a random token that the browser presents in a cookie. Clicking "log out" deletes one row; an attacker's forged session is a different row that only disappears if you delete it too. Clearing the session table after a compromise forces every user, legitimate or not, to authenticate again, which is exactly the property you want.
Indicators of compromise are usually a sequence, not a single event. A lone 400 response on a password-reset endpoint is noise; a 400 there followed shortly by a successful call to a "who am I" endpoint from the same client is a pattern that suggests injection succeeded and a session was obtained. Detection engineering works by expressing such sequences as queries over logs, which requires that request paths, status codes and client addresses are recorded in the first place.
Password hashing limits damage but does not remove it. bcrypt is a slow, salted hashing function designed so that each guess costs real compute, which makes bulk cracking of stolen hashes expensive. It does not stop an attacker from targeting weak passwords or reusing the associated email addresses for phishing. n8n's separate note about a historical plain-text bug shows why organisations audit old storage paths, not just current code: data written under an old flaw can outlive the fix.
We teach this
How to use this in practice
Inventory every internal tool that holds database credentials. List dashboards, BI tools, ETL jobs, notebooks and admin panels, and for each note which databases it can reach and with what privilege. Done looks like a table with a row per tool, an owner, the connection account used and whether that account is read-only. Include the port each tool listens on and the date its version was last updated, since the fix in this case was a version bump. Any row showing a shared admin account is your first remediation ticket.
Put an authentication or network gate in front of analytics endpoints. If you run Metabase or a similar tool, check whether its web port is exposed to the internet by running
nmap -p 3000 <your-host>from outside your network, or by searching your cloud provider's security-group rules for 0.0.0.0/0 on that port. Done means the service is only reachable via a VPN, an identity-aware proxy or an allow-listed range, and you have a screenshot or config export proving it.Write one detection query for a request sequence. Using whatever log store you have, even a local file and
grep, build a query that finds a POST to a login or reset endpoint returning 400 followed within five minutes by a 200 on a session-info endpoint from the same source address. Done means the query runs, returns zero rows on your normal traffic and returns a hit when you replay a synthetic pair of requests withcurl.Rehearse a credential-rotation drill for one database. Pick a non-production database, rotate the password used by one analytics tool, update the tool's connection and confirm dashboards still load. Time the exercise and write down each manual step. Done means a short runbook exists that someone else could follow in under thirty minutes, which is what you will need on the day a vendor's advisory says to rotate connected credentials. Repeat the drill with a second tool once the first run is smooth.
Sources
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report