Critical Metabase Zero-Day Exploited to Steal Customer Data at Framework and Tally

Metabase disclosed on August 7 that its Metabase Cloud SaaS platform was compromised through a previously unknown vulnerability affecting versions 1.58 and above — an unauthenticated SQL injection flaw that gives a remote attacker administrator access to a customer's instance, rated Critical with a CVSS score of 10.0, BleepingComputer reported. CEO Sameer Al-Sakran warned that self-hosted installations are also vulnerable, and confirmed the flaw has been actively exploited.

Framework and Tally Confirm Breaches

Laptop maker Framework notified 'all customers' that hackers stole their names, email addresses, phone numbers and physical addresses after attackers accessed its Metabase instance on August 3 — with Metabase notifying the company on August 6. Tally, the online form builder, also confirmed its analytics environment was compromised on August 3, reaching customer email addresses and passwords as cryptographic hashes, which cannot be reversed. LexisNexis separately warned customers of disruption to its Diligence, Metabase API and Newsdesk services after unusual activity on servers hosted by a third-party vendor.

Patches and Remediation

The vulnerability has been fixed in patched versions across all affected branches, with the minimum safe releases being 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5. Metabase recommends that self-hosted customers upgrade immediately, revoke all active user sessions, review API keys and administrator accounts for unauthorized changes, rotate credentials for connected databases, and inspect logs for signs of compromise — identifiable by a POST request to the reset-password endpoint returning a 400 status code followed by a successful session request.