Metabase SQLi Zero-Day Attacks on Customer Data

A critical security vulnerability in Metabase, known as SQL injection, has been exploited in recent zero-day attacks. These attacks aim to steal customer data and have already affected several companies, including Framework and Tally. The vulnerability allows attackers to gain unauthorized access to databases by injecting malicious SQL queries into the application. The flaw has been classified as CVE-2026-XXXX and affects specific versions of the Metabase software. Security researchers have noted that the attacks have increased over the past week, indicating a targeted campaign.

The exact number of affected systems is currently unclear; however, significant data loss is anticipated. Affected companies have already taken measures to close the vulnerability. Metabase has released an update that addresses the flaw and updates the affected versions. Installation of the update is strongly recommended to prevent further data loss. The attacks utilize a combination of social engineering and technical exploits to gain access to the systems.

Security analysts report that attackers often begin with phishing emails to deceive employees and steal credentials. Once inside the system, they can apply the SQL injection technique to access sensitive data. The response from the affected companies includes not only the installation of the update but also a review of their security protocols. Framework and Tally have initiated internal audits to determine how the attackers were able to breach their systems. These measures are part of a broader plan to enhance cybersecurity.

Experts warn that such attacks may increase in the future as more companies adopt cloud-based solutions. The reliance on software like Metabase makes it an attractive target for cybercriminals. Companies are urged to strengthen their security measures and conduct regular training for employees to minimize the risk of phishing attacks. The vulnerability has also impacted the perception of Metabase as a trusted platform. Customers and partners may have concerns regarding data security, which could negatively affect business relationships.

However, Metabase has emphasized that the security of its users is a top priority and that they are continuously working to improve their systems. The exact number of affected customers and the nature of the stolen data are not yet fully known. Security researchers are working to assess the impact of the attacks and support the affected companies. Investigations are ongoing, and further information is expected to be released in the coming days. The vulnerability was discovered on August 1, 2026, and the first attacks were reported shortly thereafter. Companies using Metabase should promptly review their systems and ensure that they have installed the latest security updates.