Central Intelligence
Central Intelligence®PERSPECTIVE IS EVERYTHING
Last Update: 10/27/2026 at 6:00 AM EST

Metabase SQL-Injection Zero-Day

Coverage from The Open Letter, Help Net Security, and others

Metabase SQL-Injection Zero-Day topic image

A critical unauthenticated SQL-injection vulnerability in Metabase enabled attackers to obtain administrator access to affected instances and potentially reach connected databases and export information.

Reported victims included Framework, Tally, Kilo Code, n8n, ChecklyHQ, and organizations exposed through service providers such as Marsello. The incidents involved personal details, password hashes, database credentials, cloud records, and access tokens. The episode also raises broader questions about third-party data exposure, subprocessor oversight, and the response obligations of organizations whose data is handled through vendor chains.

Looking Back
10 Day Timeline
Aug 7Aug 9Aug 11Aug 12Aug 14Aug 16
All Articles4 articles
Important4 articles · CI Score 60 and above
The Open Letter / Jason Mill
Lego SA Customer Data Exposed Through Vendor’s Metabase Breach
Lego Certified Stores South Africa notified customers in August that email addresses and mobile numbers were exposed through a Metabase breach affecting Marsello's vendor chain.
8/16/2026 • Data Breaches & Exposure Events • General
Help Net Security / Zeljka Zorz
Metabase Zero-Day Exposed Customer Data At Three Companies
Metabase disclosed on August 6, 2026, that attackers exploited a zero-day SQL injection vulnerability in Metabase Cloud, exposing customer data at Framework, Tally, and Kilo Code.
8/10/2026 • Data Breaches & Exposure Events • General
BleepingComputer / Mayank Parmar
Metabase Zero-Day Exposes Customer Data At Framework And Tally
Metabase disclosed active exploitation of a critical SQL injection vulnerability, prompting customer-data investigations at Framework, Tally, and LexisNexis after compromised instances were accessed on August 3.
8/7/2026 • Data Breaches & Exposure Events • General
Tech Times / Clayton Lewis
Metabase Flaw Exposes Data At Five Companies
Attackers exploited CVE-2026-72898 in self-hosted Metabase installations from August 2 through August 6, 2026, breaching five companies and exposing personal information and credentials.
8/12/2026 • Data Breaches & Exposure Events • General