Critical Metabase SQL Injection Flaw Used in Zero-Day Data Theft Attacks

Exploitation Path Revealed in Early August

Metabase announced on Thursday that a critical SQL injection vulnerability was actively exploited in zero‑day attacks. The breach targeted customer instances hosted on Metabase Cloud, stealing data from organizations that use the Framework and Tally integrations. The attacks surfaced in early August 2026 and prompted an urgent security advisory.

The flaw resides in Metabase’s query‑building engine, allowing attackers to inject malicious SQL commands into database calls. By bypassing authentication checks, threat actors could retrieve entire tables from compromised accounts. Metabase’s investigation suggests the exploit was weaponized within days of discovery, indicating a highly skilled adversary with rapid development capabilities.

Security researchers traced the attack chain to a crafted HTTP request that manipulated Metabase’s API endpoint. The request injected a payload that altered the underlying SQL statement, granting full read access to the database. Metabase’s engineering team confirmed that the vulnerability affected versions deployed on its SaaS platform, specifically those interfacing with Framework and Tally modules. „We are working with affected customers to contain the breach and improve our defenses,” a Metabase spokesperson said in the advisory.

Will Other Metabase Users Face Similar Risks?

The advisory noted that the attackers exfiltrated data over a two‑week window before detection. Affected organizations reported unauthorized access to customer records, financial reports, and internal analytics. Metabase has rolled out emergency patches and urged all users to apply the updates immediately. The company also recommended rotating credentials and reviewing audit logs for suspicious activity.

While the current evidence points to Framework and Tally users, analysts warn that any Metabase Cloud deployment lacking the latest security patches could be vulnerable. The zero‑day nature of the exploit means that attackers may have tested additional vectors before the public disclosure. Experts advise organizations to conduct thorough penetration testing and to enforce least‑privilege access controls across all database connections.

The incident underscores the growing threat landscape for business intelligence tools that handle sensitive data. Metabase’s rapid response demonstrates a commitment to transparency, but the episode may erode trust among enterprise customers. Ongoing monitoring and collaboration with security partners will be essential to prevent future breaches.

Frequently Asked Questions

What immediate steps should Metabase customers take? Apply the emergency patch released by Metabase, rotate all database credentials, and review audit logs for any anomalous queries.

Is the vulnerability limited to Framework and Tally integrations? Current evidence links the exploit to those modules, but any Metabase Cloud instance without the patch could be at risk.

How did the attackers gain initial access? They sent a specially crafted API request that injected malicious SQL, bypassing authentication and retrieving data directly from the backend database.