Threat Intelligence Report

Inside the Metabase SQLi: Exploited in the Wild

📅 August 10, 2026 📰 www.wiz.io 🔍 0 CVE(s) referenced

A critical zero-day SQL injection vulnerability in Metabase's /api/session/reset_password endpoint has been actively exploited in the wild, allowing attackers to inject arbitrary SQL via a crafted user-id parameter, prompting urgent patching for all self-hosted instances.

vendor

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap

🎯 IOC Extraction

⚔️ MITRE ATT&CK TTPs

📦 STIX 2.1 Bundle