Metabase Zero-Day (CVSS 10.0) Exploited in the Wild: Unauthenticated SQL Injection Grants Admin Access — Detection and Response Guide

---
title: Metabase Process Spawning Shell or Command Interpreter
id: 3f8a1c44-2b7d-4e91-a6c3-9d0e5f7b2a18
status: experimental
description: Detects the Metabase Java process spawning shells or scripting interpreters, a strong post-exploitation indicator following SQL injection to code execution via database features.
references:
  - https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains: 'metabase.jar'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate backup or maintenance scripts invoked by wrappers around the Metabase service are uncommon but possible in heavily customized deployments
level: critical
---
title: Suspicious Unauthenticated Requests to Metabase API
id: 8c2d5e71-4a9f-4b36-b8d1-7e3a0c9f5d42
status: experimental
description: Detects HTTP requests to Metabase API endpoints containing SQL injection metacharacters in query strings or payloads, as observed in web server and reverse proxy logs.
references:
  - https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/api/'
      - '/api/session'
      - '/api/user'
      - '/api/database'
      - '/api/card'
      - '/api/dataset'
  selection_sqli:
    cs-uri-query|contains:
      - '%27'
      - '%22'
      - 'UNION'
      - 'union%20select'
      - '%20OR%20'
      - 'SELECT%20'
      - 'INSERT%20'
      - 'UPDATE%20'
      - 'DELETE%20'
      - '--'
      - '%3B'
  condition: selection_uri and selection_sqli
falsepositives:
  - Vulnerability scanners and authorized penetration tests
  - Aggressive WAF testing tooling
level: high
---
title: Outbound Network Connection From Metabase Server Process
id: 5e7b9d02-6c1a-4f83-92e4-1b5d8a3c7f60
status: experimental
description: Detects the Metabase Java process initiating outbound connections to rare external destinations, indicating possible reverse shell or data exfiltration following compromise. Baselining of known warehouse destinations is required.
references:
  - https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains: 'java'
    CommandLine|contains: 'metabase'
  filter_loopback:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  filter_known_ports:
    DestinationPort:
      - 443
      - 5432
      - 3306
      - 1433
      - 5439
      - 27017
  condition: selection and not (filter_loopback and filter_known_ports)
falsepositives:
  - Metabase connecting to newly added data sources or external identity providers
  - Telemetry endpoints if not disabled
level: medium

// Hunt 1: Suspicious requests to Metabase API with SQLi indicators in proxy/WAF logs
let sqli_patterns = dynamic(["%27", "UNION", "union%20select", "SELECT%20", "INSERT%20INTO", "UPDATE%20core_user", "DELETE%20FROM", "%3B--", " OR 1=1", "or%201%3D1"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any ("/api/session", "/api/user", "/api/database", "/api/dataset", "/api/card", "/api/health")
| extend UrlLower = tolower(RequestURL)
| where UrlLower has_any (sqli_patterns) or (AdditionalExtensions has_any (sqli_patterns))
| summarize RequestCount = count(), UniqueURLs = dcount(RequestURL) by SourceIP, RequestURL, RequestMethod, ApplicationProtocol, DeviceAction, bin(TimeGenerated, 1h)
| order by RequestCount desc;

// Hunt 2: Metabase host spawning shells or making rare outbound connections (requires Defender for Endpoint or Sysmon-for-Linux ingestion)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessCommandLine has "metabase"
| where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc;

// Hunt 3: Syslog-based hunt for Metabase service anomalies (auth/session events)
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("metabase", "core_user", "api/session")
| where SyslogMessage has_any ("new user", "password reset", "api key", "admin")
| summarize by TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc;

-- Metabase Zero-Day Post-Exploitation Hunt
-- Identifies shells/tools parented by the Metabase Java process and unexpected outbound connections

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'metabase'

LET metabase_pids = SELECT Pid FROM procs

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       'Child of Metabase process' AS Finding
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM metabase_pids)
  AND (Name =~ '(sh|bash|dash|python|perl|curl|wget|nc|ncat|socat)$'
       OR CommandLine =~ '(base64|/dev/tcp|chmod \+x|/tmp/|/dev/shm/)')

UNION ALL

SELECT NULL AS Pid, NULL AS Ppid, Name, NULL AS CommandLine,
       Rexe.Addr AS Exe, Laddr.Addr AS Username, NULL AS CreateTime,
       'Outbound connection held by Metabase-linked binary' AS Finding
FROM netstat()
WHERE State = 'ESTABLISHED'
  AND Rexe.Addr !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'
  AND Name =~ 'java'

#!/bin/bash
# metabase-zero-day-triage.sh — Security Arsenal IR triage for Metabase unauthenticated SQLi (Aug 2026)
# Run as root or with sudo. Produces evidence bundle; does NOT modify the system.
set -u
OUT="/tmp/metabase_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"

echo "[*] Identifying Metabase process and version..."
ps aux | grep -i '[m]etabase' | tee "$OUT/metabase_process.txt"
MB_JAR=$(ps aux | grep -oP '(?<= )\S*metabase\.jar' | head -1)
if [ -n "$MB_JAR" ] && [ -f "$MB_JAR" ]; then
  unzip -p "$MB_JAR" META-INF/MANIFEST.MF 2>/dev/null | grep -i version | tee "$OUT/metabase_version.txt"
fi

echo "[*] Checking for shells/tools spawned by Metabase (post-exploitation indicator)..."
MB_PID=$(pgrep -f 'metabase.jar' | head -1)
if [ -n "$MB_PID" ]; then
  ps --ppid "$MB_PID" -o pid,ppid,user,cmd | tee "$OUT/metabase_children.txt"
  ls -l /proc/"$MB_PID"/cwd 2>/dev/null | tee -a "$OUT/metabase_children.txt"
fi

echo "[*] Listing established outbound connections from the Metabase process..."
ss -tnp 2>/dev/null | grep -i java | tee "$OUT/metabase_connections.txt"

echo "[*] Checking Metabase application DB for recently created users/admins (H2 default path)..."
find / -name 'metabase.db.mv.db' -o -name 'metabase.db.h2.db' 2>/dev/null | tee "$OUT/appdb_paths.txt"

echo "[*] Pulling recent Metabase and reverse-proxy logs for unauthenticated API hits..."
journalctl -u metabase --since '14 days ago' 2>/dev/null | grep -Ei 'api/(session|user|database|dataset|card)' | tee "$OUT/api_requests_journal.txt"
for log in /var/log/nginx/access.log /var/log/apache2/access.log /var/log/haproxy.log; do
  [ -f "$log" ] && grep -Ei 'api/(session|user|database|dataset|card)' "$log" | grep -Ei '(\%27|union|select|insert|update|delete|1=1)' | tee -a "$OUT/sqli_hits_proxy.txt"
done

echo "[*] Checking for web shells / dropped files in common writable paths..."
find /tmp /dev/shm /var/tmp -type f -mmin -20160 \( -name '*.sh' -o -name '*.py' -o -name '*.elf' -o -perm -111 \) 2>/dev/null | tee "$OUT/suspicious_files.txt"

echo "[+] Triage bundle complete: $OUT"
echo "[!] NEXT STEPS:"
echo "    1. If any child shells, unknown outbound connections, or unexpected admin users are found:"
echo "       isolate the host (block egress, preserve volatile memory) and escalate to IR."
echo "    2. Upgrade Metabase to the vendor-fixed release per https://www.metabase.com/blog/security"
echo "    3. Rotate ALL credentials: data-source passwords stored in Metabase, admin passwords, API keys."
echo "    4. If the application DB is H2 (default), plan migration to PostgreSQL/MySQL per vendor guidance."