Affected Systems

Metabase (specific versions not disclosed). Confirmed victims include Framework and Tally customer instances. All unpatched Metabase deployments potentially at risk.

Exploitation Status

Active exploitation confirmed. Zero-day attacks targeting customer instances for data theft. No CVE assigned yet.

Business Impact

Critical SQL injection allows attackers to extract sensitive data from Metabase instances. Confirmed breaches at Framework and Tally indicate active targeting. Organizations using Metabase for business intelligence face immediate risk of data exfiltration. Patch status and affected version range not yet publicly disclosed, complicating remediation efforts.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately isolate or restrict network access to all Metabase instances until vendor patch is available and applied
  • Review Metabase access logs and database query logs for suspicious SQL activity or unauthorized data access
  • Contact Metabase support directly to obtain emergency patch or mitigation guidance for your specific version
  • Audit all data accessible through Metabase and prepare breach notification procedures if compromise is suspected
  • Monitor Metabase security advisories and apply patches immediately upon release