Full Report
A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]
Analysis Summary
# Incident Report: Exploitation of Metabase SQL Injection Zero-Day
## Executive Summary
A critical zero-day unauthenticated SQL injection (SQLi) vulnerability in Metabase (versions 1.58+) was exploited by threat actors to compromise both Metabase Cloud and self-hosted instances. The attack allowed unauthorized administrator access, leading to data theft from high-profile organizations including Framework and Tally. Metabase has since patched the vulnerability and blocked the malicious endpoints.
## Incident Details
- **Discovery Date:** August 6, 2026 (Reported by Metabase to customers)
- **Incident Date:** August 3, 2026 (Observed exploitation)
- **Affected Organization:** Metabase (SaaS), Framework, Tally, LexisNexis
- **Sector:** Technology / SaaS / Data Analytics
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 3, 2026
- **Vector:** Unauthenticated SQL Injection (Zero-Day)
- **Details:** Attackers exploited a flaw in the `/api/session/reset_password` endpoint to inject arbitrary SQL, gaining administrative control over the Metabase instance.
### Lateral Movement
- **Details:** Once administrator access was achieved, attackers accessed connected application databases and configuration settings.
### Data Exfiltration/Impact
- **Framework:** Theft of customer names, emails, IP addresses, billing/shipping addresses, and business tax IDs (VAT/EIN).
- **Tally:** Theft of user email addresses and cryptographic password hashes.
- **LexisNexis:** Service disruption of "Diligence" and "Newsdesk" services via Metabase API compromise.
### Detection & Response
- **How it was discovered:** Metabase identified "unusual activity" and an unknown vulnerability on their Cloud platform.
- **Response actions taken:** Metabase blocked the exploited endpoints, developed a patch, and force-upgraded all Cloud customers. LexisNexis disconnected affected third-party systems to contain the breach.
## Attack Methodology
- **Initial Access:** Unauthenticated SQL Injection via the password reset API.
- **Persistence:** Creation or modification of administrator accounts; potential theft of API keys.
- **Privilege Escalation:** Direct escalation to Administrator status via SQL injection.
- **Defense Evasion:** Not explicitly detailed, though the use of a zero-day inherently bypasses signature-based defenses.
- **Credential Access:** Theft of stored credentials for connected databases and user password hashes.
- **Discovery:** Reconnaissance of the Metabase application database and connected data sources.
- **Collection:** Exporting data from connected databases.
- **Exfiltration:** Standard data export features within the Metabase administrative UI.
- **Impact:** Massive data theft and operational downtime for third-party services.
## Impact Assessment
- **Financial:** High (potential regulatory fines and forensic costs for victims like Framework and Tally).
- **Data Breach:** Large scale; includes PII, shipping logistics, and hashed credentials.
- **Operational:** Significant; LexisNexis reported service unavailability for multiple products.
- **Reputational:** High for Metabase as a trusted data visualization provider.
## Indicators of Compromise
- **Network indicators:** POST requests to `hxxp[://]<host>/api/session/reset_password` returning a **400** status code.
- **Behavioral indicators:** Successful GET requests to `hxxp[://]<host>/api/user/current` immediately following the 400 error on the reset endpoint.
- **File indicators:** Unauthorized changes in Metabase system logs or query history.
## Response Actions
- **Containment:** Blocking access to the `/api/session/reset_password` endpoint.
- **Eradication:** Patching Metabase to versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5.
- **Recovery:** Revoking all active user sessions, rotating credentials for all connected databases, and reviewing administrator account logs for unauthorized additions.
## Lessons Learned
- **Key Takeaways:** Even "secondary" tools like BI/analytics platforms have "keys to the kingdom" access to production databases.
- **What could have been done better:** Implementation of stricter egress filtering and more robust input validation on password reset endpoints could have mitigated the SQLi impact.
## Recommendations
- **Prevention:** Immediately upgrade Metabase to the minimum safe versions.
- **Monitoring:** Implement alerting for anomalous 400-series errors on sensitive API endpoints.
- **Hardening:** Follow the principle of least privilege for database service accounts connected to Metabase; ensure they only have read access to necessary tables.