Security researchers and vendor advisories confirmed that attackers actively exploited an unpatched, maximum-severity zero-day vulnerability in Metabase—the open-source business intelligence (BI) platform widely used by tech firms and Web3 organizations. Carrying a CVSS score of 10.0, the vulnerability affects Metabase versions 1.58 through 1.63.
The exploit targets the /api/session/reset_password API endpoint. An unauthenticated remote attacker can inject arbitrary SQL straight into the Metabase application database, immediately escalating privileges to full administrator status. Multiple real-world victims have already issued breach notifications, confirming attackers used this access to exfiltrate database connections and configuration parameters.
The Pipeline to Crypto Theft
Business intelligence engines act as a central junction box connecting multiple sensitive databases. For Web3 protocols, decentralized exchanges (DEXs), and liquidity managers, compromising Metabase unlocks critical assets:
Metabase stores encrypted and cached credentials to every connected database (e.g., PostgreSQL, MySQL, Snowflake). Once an attacker gains admin control over Metabase, they can dump stored database credentials in cleartext. This gives them direct, unmonitored access to production transaction databases, user wallet mapping tables, and backend state databases.
Exfiltrating customer databases grants attackers detailed records of high-net-worth Web3 users, including email addresses, login IP histories, and linked wallet addresses. Threat actors cross-reference these lists to launch hyper-targeted spear-phishing, SIM-swapping, and social engineering attacks against project founders and multisig keyholders.