{"slug": "the-metabase-sqli-exploited-in-the-wild", "title": "The Metabase SQLi: Exploited in the Wild", "summary": "On August 6, 2026, Metabase disclosed a security incident involving a zero-day SQL injection vulnerability (GHSA-vwf4-m7j8-wcjf/CVE-2026-72898) in the Metabase platform, which was exploited in the wild against Metabase Cloud. Wiz Research reported that roughly 13% of cloud environments have self-hosted Metabase instances, with about 25% fully internet accessible, and approximately 2,500 instances inventoried by Shodan. The vulnerability affects versions 1.58 and later, and Wiz used an AI agent to reverse-engineer the patch, highlighting how AI can accelerate defensive security.", "body_md": "On August 6th, 2026, Metabase disclosed a security incident. An attacker used a zero-day SQL Injection vulnerability (GHSA-vwf4-m7j8-wcjf)/CVE-2026-72898) in the Metabase platform against Metabase Cloud.\n\nSince then, further announcements have been made by impacted companies, including:\n\nSelf-hosted Metabase instances must be patched as soon as possible. Wiz Research published a Threat Intel Center alert to customers upon Metabase’s disclosure. However, given the severity of this vulnerability and reported in-the-wild exploitation, we think it’s important to share more publicly. We also wanted to use this as an opportunity to highlight how AI can accelerate defensive security.\n\nAs of noon UTC on August 10th, we have observed public proof-of-concept exploits open-sourced.\n\nBy the numbers\n\nWiz observed that roughly 13% of cloud environments have self-hosted Metabase instances deployed. Of those instances, approximately 25% are fully internet accessible.\n\nIn terms of public data, we can see ~2,500 Metabase instances inventoried by Shodan.\n\nReverse Engineering the Vulnerability\n\nThe initial Metabase disclosure gives a few critical hints as to the underlying vulnerability:\n\nThe class of vulnerability is SQL Injection\n\nThe entrypoint is /api/session/reset_password\n\nThe vulnerability is present in versions 1.58+\n\nDocker images are available for fixed versions\n\nHowever, the details of the vulnerability were not released, and the patch was only made available via releases - it is not public in the current GitHub repository.\n\nIn such cases it is necessary for Wiz Research to reverse engineer the vulnerability, in order to ensure prompt detection and validation can be offered to customers. To do so, we are able to leverage the expertise developed from building autonomous AI systems for vulnerability research. We are withholding our full PoC to avoid enabling exploitation, while ensuring defenders have the necessary information to respond.\n\nThe process for reversing such vulnerabilities can be generically described through the following process:\n\nDownload vulnerable and patched JARs - in this case we used v0.58.22 and v0.58.24\n\nCompare contents and develop a diff\n\nDecompile compiled Clojure for the relevant class\n\nClone open source code, and correlate bytecode diff to source\n\nHaving reversed the patch, use it as a pointer to reconstruct the vulnerability\n\nWe prompted an agent with this process, which revealed the SQL Injection vulnerability, with the following (pseudocode) patch as the smoking gun:\n\n```\n(when-let [user-id (:user-id $)]\n  -  (t2/select-one [:model/User ...] :id user-id))\n  +  (if (pos-int? user-id)\n  +    (t2/select-one [:model/User ...] :id user-id)\n  +    (log/warnf \"Provider %s returned a non-positive-int :user-id (type %s); refusing to resolve a user.\"\n  +               provider (type user-id))))\n```\n\nTechnical Details\n\nThe patch validates user-id as a positive integer before querying. However, user-id is not a documented parameter of /api/session/reset_password, which only expects a token and a password.\n\nSo, we can infer that the vulnerability entails providing an extra user-id key in the JSON body that the API doesn't strip. Following this lead, we used an agent to reconstruct the vulnerability, which ties together a few interesting language and framework behaviors:\n\nClojure's merge function combines two maps, with the second map's values overwriting the first's. Critically, it does not strip extra keys from the first map, but rather they simply pass through. In the vulnerable code, the incoming request is merged with the authentication result: (merge request (authenticate ...)). When authentication fails, the result contains no user-id, so an attacker-supplied user-id from the request survives the merge untouched.\n\nJSON keywordization converts JSON keys into Clojure keywords during parsing. An attacker's payload {\"user-id\": {\"raw\": \"SQL\"}} becomes the Clojure map {:user-id {:raw \"SQL\"}}. This is standard behavior, but it enables the next step.\n\nHoneySQL's :raw keyword is a feature that allows embedding literal SQL strings, bypassing parameterization. It's intended for cases where developers need to include SQL that can't be expressed through the query builder. When the attacker-controlled {:raw \"SQL\"} value reaches a HoneySQL query, it's interpreted as a directive to inject the SQL string directly.\n\nThe injection completes when the surviving user-id value is passed to t2/select-one :id user-id. Instead of receiving an integer like 123, the query receives {:raw \"(...)\"}, which HoneySQL compiles into unparameterized SQL achieving arbitrary blind SQL injection.\n\nMetabase supports multiple databases: H2 by default, but PostgreSQL, MySQL, or MariaDB are recommended for production. The injection payload is database-dependent. The vulnerability has been present since version 1.58. This was when the auth_identity module was refactored, which introduced this vulnerability.\n\nVariant Hunting\n\nOnce we identified the root cause, we also made a quick pass at identifying any unpatched variants of this issue lingering in the repository. This included generating Static Analysis rules for the relevant code patterns, running them to generate candidates, and using our agentic approach to validate or invalidate those candidates. In this case, we reviewed all merge.*request patterns, as well as all auth-identity/login! call sites.\n\nRecommendations\n\nIf you need to investigate manually:\n\nReview /api/session/properties to determine if a Metabase instance is running a vulnerable version\n\nTo check for exploitability, you should modify the following command with your desired SQL:\n\nWiz customers should refer to the pre-built advisory in the Wiz Threat Intel Center for actionable steps to investigate, remediate, and harden their environments. Wiz Research will continue to update that advisory as the situation develops.\n\nAutomating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.\n\nAnnouncing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed.\n\nGet a personalized demo\n\nReady to see Wiz in action?\n\n\"Best User Experience I have ever seen, provides full visibility to cloud workloads.\"\n\nDavid EstlickCISO\n\n\"Wiz provides a single pane of glass to see what is going on in our cloud environments.\"\n\nAdam FletcherChief Security Officer\n\n\"We know that if Wiz identifies something as critical, it actually is.\"\n\nGreg PoniatowskiHead of Threat and Vulnerability Management", "url": "https://wpnews.pro/news/the-metabase-sqli-exploited-in-the-wild", "canonical_source": "https://www.wiz.io/blog/inside-the-metabase-sqli-exploited-in-the-wild", "published_at": "2026-08-16 23:45:33+00:00", "updated_at": "2026-08-17 00:10:29.293843+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-research", "ai-tools"], "entities": ["Metabase", "Wiz Research", "Shodan", "CVE-2026-72898", "GHSA-vwf4-m7j8-wcjf"], "alternates": {"html": "https://wpnews.pro/news/the-metabase-sqli-exploited-in-the-wild", "markdown": "https://wpnews.pro/news/the-metabase-sqli-exploited-in-the-wild.md", "text": "https://wpnews.pro/news/the-metabase-sqli-exploited-in-the-wild.txt", "jsonld": "https://wpnews.pro/news/the-metabase-sqli-exploited-in-the-wild.jsonld"}}