Metabase patches exploited SQL injection after Framework and Tally report data theft

Why it matters

Metabase can hold the credentials and permissions needed to query connected databases, so one unauthenticated flaw turned an analytics tool into a route to customer records.

Sameer Al-Sakran, founder and CEO of Metabase, disclosed on August 6 that an attacker had used a previously unknown vulnerability against Metabase Cloud, forcing Metabase to block the affected endpoints and patch customer instances. BleepingComputer reported on August 7 that laptop maker Framework and form builder Tally had confirmed data theft from their Metabase environments. (Metabase)

The breach cuts into the architecture behind Metabase. While serving as CTO of startup studio Expa, Al-Sakran created the first version of Metabase because the business-intelligence products available to Expa's companies were expensive or difficult to deploy. Expa spun the internal tool into a standalone company, with Al-Sakran taking over as founder and CEO. Metabase's founding promise was straightforward: employees should be able to explore company data without waiting for an analyst or engineer. (Expa)

That access model makes the analytics application a valuable target. Metabase sits between users and the databases or warehouses holding a company's operational information. The vulnerability allowed an unauthenticated attacker to inject SQL into the Metabase application database and gain administrator access, according to the company's security advisory. An administrator can alter configuration, retrieve stored credentials for connected databases, query information available through those connections and export the results. (GitHub)

A password-reset endpoint opened the route to admin access

Metabase rated the flaw Critical, with a CVSS score of 10.0, and confirmed active exploitation. The advisory had no CVE identifier as of August 7. (GitHub)

Metabase identified the likely attack pattern as a POST request to /api/session/reset_password that returns an HTTP 400 response, followed by a successful GET request to /api/user/current. Metabase said instances showing that sequence in application or ingress logs were likely compromised. (Metabase)

Metabase Cloud customers have already been upgraded. Organizations operating self-hosted deployments must install a patched release themselves. The minimum safe versions are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5. Administrators unable to upgrade immediately should block the password-reset endpoint, Metabase said. (Metabase)

Installing the patch only closes the entry point. Metabase also instructed administrators to revoke active sessions, inspect API keys and administrator accounts, rotate credentials for every connected database, and review warehouse logs and query history. Those steps reflect the reach an attacker may have obtained after taking control of an instance. (Metabase)

Framework and Tally trace exposure to August 3

Framework told customers that its Metabase instance was accessed on August 3. The exposed information included names, email addresses, login IP addresses, billing and shipping addresses, phone numbers and company names, according to the notification reviewed by BleepingComputer. Records belonging to Framework for Business customers may also have contained VAT numbers, employer identification numbers and billing email addresses. Framework said order and payment information was not included. (BleepingComputer)

Tally also placed the compromise of its analytics environment on August 3. Tally said attackers obtained users' email addresses and password hashes, while its forms and submitted answers were stored separately and were not reached. The notification cited by BleepingComputer did not identify the hashing algorithm or specify whether the hashes were salted, details that determine how resistant exposed hashes are to offline cracking attempts. (BleepingComputer)

LexisNexis separately notified customers of unusual activity on infrastructure operated by a third-party provider and reported a disruption involving Diligence and its Metabase API. Its notice did not establish that data was stolen or conclusively tie the disruption to the same exploitation campaign. (BleepingComputer)

The confirmed victims show why an analytics breach can reach beyond dashboards. Companies routinely connect Metabase to customer, sales, product and operational databases. Even when the application does not hold every underlying record itself, stored connection credentials can give an intruder a route into those systems.

Al-Sakran faces a test of the open-source distribution model

Metabase offers a managed cloud service alongside software that customers can deploy on their own infrastructure. Its website says more than 100,000 companies use the product and millions of people use its open-source edition. Those are company-reported figures, and Metabase has not said how many Cloud or self-hosted instances were accessed in this campaign. (Metabase)

The split distribution model gives Metabase control over patching Cloud customers, while leaving the timing of self-hosted upgrades to individual operators. Metabase confronted the same problem after a severe unauthenticated remote-code-execution chain in July 2023. In its postmortem, Metabase said it could rapidly patch the servers it managed but had no way to force tens of thousands of open-source users to update. (Metabase)

A separate vulnerability disclosed in February 2026 allowed an authenticated user to extract database connection details through malicious notification templates. Metabase said it found no evidence that flaw had been exploited before patches were released. The August incident is materially different: exploitation is confirmed, Metabase Cloud was attacked, and customers have reported stolen data. (Metabase)

Metabase raised a $30 million Series B in 2021 led by Insight Partners, with Expa and NEA participating. The round brought its announced invested capital to $42.5 million and funded expansion of the cloud and enterprise products. Al-Sakran now has to preserve the accessibility that drove Metabase's adoption while tightening the privileged layer connecting customers to their most sensitive databases. (PR Newswire)