Metabase says attackers used a previously unknown flaw in its analytics platform to break into customer instances and steal data, including confirmed impacts at Framework and Tally. The bug is an unauthenticated SQL injection vulnerability with a CVSS score of 10.0 affecting Metabase versions 1.58 and above, including Metabase Cloud and self-hosted deployments. Metabase says patched releases include 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5, and recommends blocking /api/session/reset_password if immediate upgrading is not possible.
2026.09.17
93% relevant
This article appears to describe a specific victim of the same Metabase Cloud compromise, adding victim-level details on the data exposed at City Relay, including bank details, passwords, and lockbox codes, plus the timing of notification and mitigation steps.
Sergiu Gatlan
2026.09.10
21% relevant
The story adds downstream impact from the Metabase zero-day by reporting that ShipMonk breach notices cited Metabase exploitation as the path that exposed Trezor customer order data.
Ionut Arghire
2026.09.08
94% relevant
This article adds a named victim and impact details to the Metabase breach campaign: Mathspace says attackers exploited CVE-2026-72898 against its self-hosted Metabase instance, affecting 1,079,819 students, teachers, staff, and parents/guardians in Australia and New Zealand after delayed patching and missed compromise checks.
Sergiu Gatlan
2026.09.07
95% relevant
This article adds a newly disclosed victim and concrete impact details to the same Metabase exploitation campaign: Mathspace says attackers used a vulnerability in its self-hosted Metabase reporting system to gain administrator access and steal data for 1,079,819 people in Australia and New Zealand.
2026.08.10
95% relevant
This report identifies Framework as a confirmed victim of the Metabase zero-day, says all customers were affected, lists exposed data fields, and adds timeline and response details including Metabase's August 3 discovery and August 6 notification.
Ionut Arghire
2026.08.10
98% relevant
This source is a direct update on the same event, adding Metabase's patch availability, affected fixed versions (63.5, 62.9, 61.11, 60.17, 59.21, 58.24), temporary mitigation by blocking /api/session/reset_password, and concrete indicators of compromise tied to the Metabase Cloud attack.
info@thehackernews.com (The Hacker News)
2026.08.08
95% relevant
This is the same underlying event: the actively exploited Metabase zero-day. This source adds that the flaw can grant unauthenticated administrator access, sharpening the immediate impact and urgency for Metabase users.
Mayank Parmar
2026.08.07
100% relevant
This article establishes a new tracked incident by tying an actively exploited Metabase zero-day to confirmed customer data theft at named victims and providing concrete affected versions, mitigations, and signs of compromise.