Metabase Zero-Day Turns Dashboards Into Data Heists at Framework and Tally

Key points

• Metabase disclosed Thursday that its Cloud analytics platform was breached through a previously unknown flaw affecting versions 1.58 and above, rated maximum severity 10.0.
• The bug is an unauthenticated SQL injection: attackers needed no password to gain full administrator access to a customer's instance.
• Laptop maker Framework confirmed that names, emails, phone numbers, billing addresses and shipping addresses were stolen after its instance was accessed on August 3.
• Form-builder Tally says attackers reached user email addresses and hashed passwords, but not the forms or submitted answers.
• LexisNexis has told customers its Metabase API service was disrupted after unusual activity surfaced at a third-party vendor.

Metabase is analytics software that companies plug into their databases to build charts and dashboards. Somebody found a way to walk straight in as the boss.

On Thursday the company said its hosted service, Metabase Cloud, had been attacked through a flaw nobody knew about yet. In the trade this is called a zero-day: a bug the maker had no time to fix before attackers started using it.

The flaw is a SQL injection, one of the oldest tricks in web security. An attacker types database commands into a field that expects ordinary input, and the software obeys. Here it required no login at all. From there the attacker could hand themselves administrator rights, read anything the dashboard could reach, and grab the saved passwords Metabase uses to talk to connected databases. We covered a related technique on 5 August, when intruders ran commands from inside an Oracle database after breaking in through a sloppy search box.

Metabase CEO Sameer Al-Sakran confirmed the attacks in a blog post. The company hasn't published a CVE identifier, the standard tracking number for a public flaw, but its own advisory rates the bug 10.0 out of 10 and confirms active exploitation against real customers.

Which versions are safe?

Any Metabase from version 1.58 onwards was at risk. Cloud customers are already patched; anyone running Metabase on their own servers must update manually.

The minimum safe releases are below.

If you can't patch immediately, block access to the /api/session/reset_password endpoint. Attacks appear in logs as a POST to that address returning a 400 error, followed by a successful GET to /api/user/current. Metabase warns those same logs may have been tampered with on breached systems. Self-hosted customers should also revoke active user sessions, audit API keys and administrator accounts, and rotate credentials for any connected databases.

Who has been hit so far?

Three companies have gone public, and all three told customers something went wrong.

Framework, the modular-laptop company, told customers in a notice first reported by BleepingComputer that attackers accessed its instance on August 3; Metabase notified Framework on August 6. Stolen records include full names, email addresses, login IP addresses, phone numbers, and billing and shipping addresses. Business customers may also have lost company names, VAT numbers, EIN numbers, and billing email addresses.

Tally, the online form builder, says the same attack reached its analytics environment on August 3. Attackers got email addresses and password hashes, which are scrambled versions of passwords that can't be trivially reversed. The actual forms and submitted answers were stored separately and weren't touched. Tally hasn't said which hashing method it used or whether hashes were salted, a detail that decides how quickly an attacker could crack them.

LexisNexis told customers its Diligence service, Metabase API and Newsdesk were disrupted after unusual activity appeared on servers run by a third-party vendor. It hasn't confirmed any data was taken, and a forensic firm is investigating.

Should you worry?

If you hold a Framework or Tally account, change your password and enable two-factor authentication now. Watch for phishing emails that quote real details like your address to seem convincing. The leaked data is exactly the raw material scammers recycle in the next wave.

The wider point is worth sitting with: a CVSS 10.0 flaw in a tool that sits directly on top of production databases, requiring zero credentials to exploit, is about as bad as it gets. The patch window between exploitation and public disclosure was measured in days, not hours. Self-hosted customers who don't have automatic update pipelines are the ones who should be most worried right now.