Executive Summary
A critical zero-day SQL injection vulnerability impacting cloud-hosted instances of Metabase—a widely deployed business intelligence and data visualization platform—has been actively exploited in the wild, resulting in confirmed data breaches at multiple tech firms, including repairable laptop manufacturer Framework, form-builder Tally, and AI coding platform Kilo Code. Disclosed by Metabase on August 6, 2026, the maximum-severity flaw affects Metabase Cloud and self-hosted instances running version 58 and above. The vulnerability allows remote, unauthenticated attackers to inject arbitrary SQL statements into Metabase's core application database, bypassing authentication perimeters and granting the intruders administrative access to connected data warehouses and underlying customer databases.
Deep-Dive Technical Analysis
The vulnerability stems from improper input sanitization and parameter binding within Metabase's dynamic query builder and API routing layer in Metabase 58+. When an unauthenticated client transmits crafted HTTP requests containing malicious SQL payloads, Metabase's internal ORM fails to escape special characters before executing raw queries against the application database.
Exploitation Mechanics
1. Unauthenticated Perimeter Entry: Attackers target public-facing Metabase endpoints without needing valid session tokens or API keys.
2. Arbitrary SQL Injection: The payload bypasses input validation, permitting arbitrary SELECT, UPDATE, and UNION queries against the Metabase backend database where application credentials, session keys, and connection strings are stored.
3. Admin Session Takeover & Database Pivoting: By dumping password hashes and active session tokens or creating unauthorized administrator accounts within Metabase, threat actors elevate their privileges to full instance administrators.
4. Data Exfiltration: Armed with administrative rights over the Metabase instance, the intruders leverage Metabase's built-in database connector privileges to execute raw SQL queries against connected production databases, exfiltrating customer PII (names, email addresses, phone numbers, physical addresses, IP logs, and Slack API access tokens).
At Framework, the breach exposed customer names, email directories, phone numbers, delivery addresses, and IP logs, though payment card data remained insulated. At Tally, attackers harvested user emails and password hashes, while Kilo Code confirmed the exfiltration of Slack access tokens, which were immediately invalidated.
Industry Impact and Recommendations / Mitigations
Industry Impact
This campaign underscores the severe supply-chain risks inherent in connecting central Business Intelligence (BI) tools directly to core production databases. Because BI tools like Metabase require broad read access to operational tables to generate analytics, a single unauthenticated vulnerability in the analytics layer grants threat actors an instant pipeline to sensitive customer PII and third-party API keys across multiple cloud tenants.
Recommendations & Mitigations
* Immediate Patch Deployment: Upgrade all self-hosted and cloud Metabase instances immediately to the latest patched release (Metabase 58.x emergency security patch) provided by the vendor.
* Credential Rotation: Rotate all database passwords, service account keys, and API tokens (including Slack, AWS, and database connection strings) tied to or accessible from Metabase instances.
* Principle of Least Privilege: Restrict the database permissions assigned to BI connectors. Ensure Metabase service accounts operate with read-only views containing anonymized or masked PII where full customer records are not strictly required for reporting.
* Network Segmentation & Web Application Firewalls: Place BI endpoints behind strict Zero Trust Network Access (ZTNA) or VPN perimeters, and enforce WAF rules to detect and block SQL injection pattern signatures.