Metabase Zero-Day Exposes Framework, Tally Customer Data

Two companies told customers this week that their personal data had been stolen. Neither was breached directly. The attacker walked in through the analytics dashboard, which was both wired to their production databases.

Laptop maker Framework and form builder Tally each disclosed that customer records were accessed after an intruder exploited a zero-day in Metabase, the open-source business intelligence (BI) platform companies use to query data and build reports. 

Metabase caught the attack on its cloud service on August 3, patched it, alerted law enforcement, and notified customers on August 6. Framework emailed its own users about six hours later.

Framework said names, email addresses, phone numbers, login IPs, and billing and shipping addresses sat in the accessed database, with company names, VAT and EIN numbers also exposed for business accounts. Order and payment data were not. Tally said the attacker reached email addresses and hashed passwords; form submissions live in a separate database and were untouched.

The flaw, which has not received any CVE ID, scores a maximum 10.0 on the CVSS scale and has no CVE assigned. It lets an unauthenticated attacker — no account, no password — inject arbitrary SQL through the /api/session/reset_password endpoint and take the instance as administrator. For a BI tool that is near worst-case: admin rights expose the stored credentials for every database connected to the dashboard.

Metabase Cloud tenants were patched automatically. Self-hosted deployments were not, and every release from version 58 through 63 is vulnerable. Individuals 57 or older are unaffected.

Administrators should move to 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5 now. If patching must wait, block the reset_password endpoint at the network edge. Then search logs for the signature Metabase published: a POST to /api/session/reset_password returning 400, followed by a GET to /api/user/current returning 200. Finding it means assuming compromise — clear the core_session table, audit API keys and admin accounts, and rotate credentials for every connected database.

Metabase calls its findings preliminary and has hired outside forensic investigators. Framework says it is rethinking how much customer data it hands to external vendors at all. That is the harder question, and nothing that leaked was operational — it was a copy, parked in a reporting tool, because someone wanted a chart.