Public exploit code for the Metabase zero-day is now circulating, Wiz Research has observed, roughly four days after the vulnerability was disclosed and while unpatched self-hosted instances remain exposed.
Wiz said it found Proof-of-Concept (PoC) exploits published openly as of noon UTC on Monday. It reverse engineered the flaw by diffing vulnerable and patched builds, and withheld its own working exploit to avoid enabling attacks.
The flaw, now tracked as CVE-2026-72898, is an unauthenticated SQL injection in Metabase’s password reset endpoint, and it carries a CVSS score of 10.0. Metabase said a remote attacker can inject arbitrary SQL into the application database and gain administrator access without credentials or user interaction.
Metabase disclosed it on August 6 after its hosted Cloud platform was targeted. Cloud customers were patched before disclosure, but self-hosted deployments across every release train from x.58 through x.63 need updating.
Wiz found self-hosted Metabase in roughly 13% of cloud environments, with about a quarter of those instances fully reachable from the internet, and Shodan showed around 2,500 instances exposed to the internet.
The consequence is not confined to the dashboard layer. Metabase stores the credentials it uses to query connected databases, so administrator access exposes whatever data sources a deployment is wired into, along with the data reachable through them.
Five Companies Have Disclosed Incidents
Framework and Tally both disclosed incidents on August 7, n8n followed on August 8, Kilo Code at Anaconda on August 9, and ChecklyHQ on August 10.
Wiz traced the flaw to version 1.58, when the authentication module was refactored, and said it reconstructed the bug by prompting an AI agent through that diffing process. It published the analysis partly to show how AI can accelerate defensive security.
Metabase advised self-hosted users to upgrade to the patch matching their release branch, and advised treating any internet-facing instance as potentially compromised.
The company also recommended revoking every active session by clearing the core_session table in the application database, then reviewing API keys and administrator accounts for anything unrecognized or unexpectedly changed. It advised rotating credentials for all connected databases and checking both warehouse logs and Metabase’s own query history for unauthorized activity.
