Framework loses customer data in Metabase zero-day attack
- ID
- 12764
- Status
- summarized
- Published
- 10 Aug 2026, 7:21 PM
- Fetched
- 11 Aug 2026, 12:34 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/personal-tech/2026/08/10/framework-loses-customer-data-in-metabase-zero-day-attack/5285302
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.5
- Created
- 11 Aug 2026, 12:36 AM
- Tags
- Audience
- developersdatabase_learnerssaas_founders
What happened
Framework disclosed that a zero-day in Metabase's cloud service (affecting versions 1.58 and later) let an attacker inject arbitrary SQL, gain admin access, steal credentials for connected databases, and export customer data including names, emails, phone numbers, physical addresses, and login IPs. Metabase patched the bug on August 3 and notified Framework on August 6; Framework rotated all connected database credentials and hired a forensics firm. The breach affected 'all customers' according to TechCrunch.
Why it matters
If you run Metabase (or any BI/analytics tool) connected to production databases, this incident is a concrete reminder that those tools are a high-value attack surface with broad data access. Check your Metabase version immediately if on 1.58 or later, and audit whether your BI tool's database connections have least-privilege scopes rather than blanket read access to every table. Malaysian startups using Metabase Cloud should confirm they're patched and rotate connected DB credentials as a precaution.
Discussion angle
The attack path here—BI tool zero-day → SQL injection → admin escalation → steal connected DB credentials → exfiltrate data—is a textbook case for why analytics tools should never share credentials with or have wide access to production databases. Discuss whether your current setup isolates analytics access and what credential rotation looks like for your stack.