Metabase SQLi zero-day exploited in customer data-theft attacks
Metabase zero-day SQLi vulnerability exploited for data theft attacks.
A critical, unauthenticated SQL injection zero-day vulnerability in Metabase versions 1.58 and above has been actively exploited to steal customer data. The vulnerability allows remote attackers to gain administrator access, steal credentials, and exfiltrate data. Both Metabase Cloud and self-hosted instances are affected, with companies like Framework and Tally confirming customer data theft.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Metabase?
Get an email when a new story names Metabase, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical unauthenticated SQL injection vulnerability in Metabase (v1.58+) was actively exploited before a patch was available, allowing attackers to gain administrator access and exfiltrate sensitive customer data. Because the flaw required no authentication, any internet-exposed Metabase instance was immediately at risk without any user interaction. Companies like Framework and Tally confirmed real customer data theft, demonstrating that zero-days in business intelligence and analytics tools can serve as a direct pathway to sensitive datasets. This incident highlights the danger of exposing data-rich internal tools directly to the internet and the critical importance of rapid patch deployment and compensating controls when patches are unavailable.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.