[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ4vy9lhGgMfAHPWvv_FriwQ1vCmXcsd65YT3BGKkk8k":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"4ae0106e-2e44-49d6-8f66-834040e3718b","Metabase SQLi zero-day exploited in customer data-theft attacks","metabase-sqli-zero-day-exploited-in-customer-data-theft-attacks-ab513b","A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]","A critical, unauthenticated SQL injection zero-day vulnerability in Metabase versions 1.58 and above has been actively exploited to steal customer data. The vulnerability allows remote attackers to gain administrator access, steal credentials, and exfiltrate data. Both Metabase Cloud and self-hosted instances are affected, with companies like Framework and Tally confirming customer data theft.","Metabase zero-day SQLi vulnerability exploited for data theft attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fframework-tally-disclose-metabase-data-theft-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F07\u002Fmetabase-header.jpg","2026-08-07T20:14:46+00:00","2026-08-07T22:00:23.907584+00:00",9,[17,20,22,24],{"name":18,"type":19},"Metabase","product",{"name":21,"type":19},"Metabase Cloud",{"name":23,"type":19},"Framework",{"name":25,"type":19},"Tally","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,23],{"controls":52,"vendors":133},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":83,"name":84,"problem":85,"products":86},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":112,"name":113,"problem":114,"products":115},"patch-management","Automated patch management","Known holes get closed in days, not months.",[116,124,129],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":125,"product_name":126,"url":127,"description":128},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":112,"product_name":130,"url":131,"description":132},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":153},"metabase-sqli-zero-day-exploited-to-steal-customer-data","Metabase SQLi Zero-Day Exploited to Steal Customer Data","A critical unauthenticated SQL injection vulnerability in Metabase (v1.58+) was actively exploited before a patch was available, allowing attackers to gain administrator access and exfiltrate sensitive customer data. Because the flaw required no authentication, any internet-exposed Metabase instance was immediately at risk without any user interaction. Companies like Framework and Tally confirmed real customer data theft, demonstrating that zero-days in business intelligence and analytics tools can serve as a direct pathway to sensitive datasets. This incident highlights the danger of exposing data-rich internal tools directly to the internet and the critical importance of rapid patch deployment and compensating controls when patches are unavailable.",[139,140,141,142,143,144,145,146,147,148,149,150,151,152],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.AM-2: Software platforms and applications inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","OWASP A03:2021 – Injection","ITIL Change Management: Emergency Change Procedures",{}]