Metabase zero-day exploited: customer data stolen from Framework and Tally
A maximum-severity, unauthenticated SQL injection zero-day in analytics platform Metabase was actively exploited starting August 3rd. Metabase's own Cloud platform was breached, and customers Framework and Tally have confirmed data theft. Self-hosted instances remain exposed unti
A CVSS 10.0 unauthenticated SQL injection zero-day in the open source analytics tool Metabase let attackers gain full administrator access and steal database credentials. Metabase's Cloud platform was breached starting August 3rd; laptop maker Framework and form-builder Tally both confirmed customer data was stolen, and LexisNexis disclosed a related third-party vendor impact. Patches are live for every affected branch, but self-hosted instances stay exposed until administrators upgrade manually.