Metabase SQL Injection Zero-Day Exploited in Customer Data Theft Attacks

What Happened

According to BleepingComputer, a critical SQL injection vulnerability in Metabase — an open-source business intelligence and analytics platform — was exploited as a zero-day to breach customer instances and steal data. The report identifies Framework and Tally as companies known to be impacted by these attacks. As of this writing, no CVE identifier has been confirmed in the reporting, and full technical details of the flaw (affected versions, exact injection point) have not been disclosed.

Why It Matters

Metabase is widely deployed to connect directly to production databases for dashboards and reporting, which means a SQL injection flaw in the application layer can translate into direct exposure of backend data stores. Because this was exploited as a zero-day — before a patch or public advisory was available — organizations running self-hosted or customer-facing Metabase instances may have been vulnerable with no prior warning. Any organization exposing Metabase to the internet, or using it to query sensitive customer data, should treat this as a high-priority item to track, regardless of whether they've been named as affected.

What Defenders Should Do Now

• Inventory all Metabase instances (self-hosted and cloud) and confirm current version against forthcoming vendor guidance once a patch is released.
• Restrict public internet exposure of Metabase admin and query interfaces where possible; place instances behind authentication proxies or VPN.
• Review Metabase and database-layer logs for anomalous or malformed query patterns, unexpected use of database introspection queries, and unusual data export volumes.
• Hunt for signs of mass data export activity (large result sets, bulk CSV/API exports) from Metabase-connected databases around and after the disclosure window.
• Rotate database credentials used by Metabase connections if compromise is suspected, and review database user permissions to ensure least privilege for reporting/BI accounts.
• Subscribe to Metabase security advisories to apply a patch immediately once available.

Developing Story

This is a developing situation with limited public technical detail at this stage — no CVE number, patch, or full list of affected organizations has been confirmed beyond Framework and Tally. We will continue to monitor for a formal advisory and updated guidance. Read the original report at BleepingComputer.