Zero-day flaw in Metabase exposes customer data in active attacks
A critical SQL injection vulnerability in Metabase has been exploited in the wild to steal customer data, with attacks already impacting companies like Framework and Tally. The flaw, which remains unpatched, allows attackers to bypass authentication and extract sensitive information directly from databases.
Behind the breach: how the attack unfolds
The vulnerability, tracked as a zero-day, enables attackers to send specially crafted SQL queries to Metabase instances. By exploiting this flaw, they can gain unauthorized access to sensitive data without needing valid credentials. Security researchers observed these attacks targeting Metabase deployments hosted by companies like Framework and Tally, raising concerns about the broader exposure of customer data.
Scrambling for a fix
Metabase has not yet released a patch for the vulnerability, leaving organizations reliant on the open-source analytics platform vulnerable to ongoing attacks. In response, security teams are urged to restrict network access to Metabase instances and monitor for unusual database queries. Until a fix is available, companies using Metabase should treat all external access as potentially hostile and consider temporary workarounds, such as disabling internet-facing instances or implementing strict firewall rules.
Why it matters
This zero-day highlights the risks of unpatched software in critical infrastructure, especially in tools handling sensitive data. For companies like Framework and Tally, the exposure of customer information could lead to regulatory scrutiny and reputational damage. Users of Metabase should prioritize monitoring and isolation measures while awaiting an official patch to mitigate potential breaches.
Source: BleepingComputer. AI-assisted editorial synthesis — TechnoExpress.