A critical SQL injection vulnerability in Metabase, rated with a maximum CVSS score of 10.0, is being actively exploited to steal customer data from companies like Framework and Tally.

Key Takeaways

  • A critical unauthenticated SQL injection flaw was discovered in Metabase versions 1.58 and above.
  • The vulnerability has a perfect CVSS score of 10.0, indicating maximum severity.
  • Major companies including Framework and Tally have confirmed data breaches via this exploit.
  • Self-hosted users must manually update to patched versions immediately.

A massive wave of cyberattacks has targeted Metabase users through a previously unknown (zero-day) SQL injection vulnerability. This flaw allows unauthenticated remote attackers to gain full administrator access to a customer's instance, potentially leading to total system compromise.

The Anatomy of the Attack

Metabase CEO Sameer Al-Sakran revealed that the vulnerability affects versions 1.58 and above. By injecting arbitrary SQL into the application database, attackers can manipulate configurations, steal stored credentials for connected databases, and export sensitive data. The severity is underscored by a CVSS score of 10.0, the highest possible rating.

Read Also:Critical Cursor AI Flaw: Malicious Repositories Can Trigger Windows Code Execution

Impact on Major Organizations

The real-world consequences are already evident. Laptop manufacturer Framework confirmed that attackers accessed their Metabase instance, stealing customer names, emails, IP addresses, and billing information. Similarly, the online form builder Tally reported that its analytics environment was compromised, exposing user email addresses and cryptographic password hashes.

Why This Matters

BozokMedia analysis shows that this incident highlights the extreme risk posed by third-party analytics integrations. When a central data tool like Metabase is compromised, it creates a domino effect, exposing the sensitive data of every connected client and end-user across the supply chain.

This is not just a bug; it is a total bypass of authentication that grants attackers the keys to the entire kingdom.

Mitigation and Recovery Steps

Metabase has released patches for all affected branches. Organizations running self-hosted installations must update to safe versions such as 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5. As an emergency measure, administrators should block the /api/session/reset_password endpoint until patching is complete.

Did You Know?: SQL injection attacks remain one of the most common methods for data breaches, often targeting the very layer where applications communicate with databases.

Frequently Asked Questions

1. Is Metabase Cloud safe?
Metabase has already applied patches to its Cloud SaaS platform, but users should still monitor for any unusual activity.

2. What should self-hosted users do immediately?
Upgrade to a patched version, revoke all active user sessions, and rotate all credentials for connected databases.