How the ShinyHunters campaign worked
The ShinyHunters campaign exploited Metabase SQLi in 4 phases: (1) Reconnaissance — scan internet for exposed Metabase instances, (2) Exploitation — exploit SQLi to extract data from the Metabase application's database, (3) Lateral movement — use extracted credentials to access other systems (cloud storage, internal apps), (4) Extortion — threaten to leak or sell the data unless ransom is paid. The ShinyHunters group has been linked to several high-profile breaches and is one of the most active cybercriminal groups in 2025-2026 (Cybersecurity Dive, 2026).
Metabase security best practices
- Update Metabase to the latest patched version immediately.
- Never expose Metabase to the internet without authentication.
- Use VPN or zero-trust network access for Metabase access.
- Enable Metabase's built-in authentication (LDAP, SAML, Google OAuth, etc.).
- Use a web application firewall (WAF) like Cloudflare or AWS WAF in front of Metabase.
- Monitor Metabase logs for unusual query activity (especially for SQL keywords like 'SELECT', 'UNION', 'INSERT').
- Implement network segmentation to prevent lateral movement from a compromised Metabase instance.
- Regularly audit self-hosted applications for vulnerabilities.
- Use Metabase's built-in row-level security and column-level security to limit data access.
- Backup Metabase application data and the underlying database regularly.
How to detect Metabase compromise
- Unusual SQL queries in Metabase logs (especially for sensitive tables).
- Login attempts from unusual IP addresses.
- High volume of data downloads from the underlying database.
- New Metabase admin users not authorized by your team.
- New Metabase data sources or connections not authorized by your team.
- Unusual Metabase API activity.
- Outbound data transfers to unknown destinations.
What to do if you use Metabase
- Check your Metabase version. If below 0.49.3, update immediately.
- Audit your Metabase instance for signs of compromise (unusual queries, admin users, data downloads).
- Check whether your underlying database (PostgreSQL, MySQL, etc.) has been accessed beyond the Metabase application's normal queries.
- Notify affected customers if you store customer data in the database accessible via Metabase.
- Report the incident to CISA, the FBI, and applicable regulators (depending on jurisdiction).
- Engage an incident response firm to investigate and remediate.
- Implement the security best practices above.
What this means for self-hosted software security
The Metabase zero-day campaign highlights the risks of self-hosted software: (1) Self-hosted software is only as secure as the operator's configuration, (2) Internet-exposed instances are easy targets for attackers, (3) Vulnerabilities in widely-used open-source software can affect thousands of organizations, (4) Detection and patching can be slow for self-hosted software, (5) Cloud-hosted alternatives often have better security defaults and faster patching. Organizations using self-hosted software should: (1) inventory all self-hosted applications, (2) ensure they are not internet-exposed unnecessarily, (3) patch promptly when vulnerabilities are disclosed, (4) monitor for unusual activity (CISA, 2026).
Resources and next steps
Visit CISA.gov for the latest cybersecurity advisories. The Metabase project publishes security advisories at metabase.com/security. The ShinyHunters group has been tracked by Cybersecurity Dive, BleepingComputer, and KrebsOnSecurity. For vulnerability scanning tools, use Tenable Nessus, Qualys, or open-source OpenVAS. For incident response, consider CrowdStrike, Mandiant, or other IR firms. For WAF protection, use Cloudflare, AWS WAF, or Azure WAF.
Fazlur Rahman
