Metabase, the open-source dashboard tool thousands of companies embed so non-technical staff can query their own data, disclosed on 7 August that a maximum-severity SQL injection flaw had been exploited as a zero-day since 3 August. The bug let an attacker with no credentials at all inject arbitrary SQL into Metabase's own application database, which was enough to escalate to full administrator access. From there they could change the application's configuration, pull the stored credentials Metabase keeps for every connected data source, and read or export whatever those connections could see. Two confirmed victims have come forward: laptop maker Framework, whose customers' names, emails, phone numbers and shipping addresses were exposed, and form-builder platform Tally, where attackers walked away with user emails and password hashes.
No CVE has been assigned yet, but Metabase rates the flaw CVSS 10.0 and has shipped fixes across every affected line — versions 1.58 through 1.63, patched in 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9 and 1.63.5. Metabase Cloud customers were patched automatically; anyone running a self-hosted instance has to apply the update by hand. The company says it has blocked the endpoints used in the attack, notified affected customers, and brought in outside forensics support, but any self-hosted install that hasn't updated remains open to the same technique now that the pattern is public.
What this means for your business
If you or a client runs a self-hosted Metabase instance — check the version under Admin → About — update to the patched release for that line today, not on the next maintenance window; a CVSS 10.0 rating with confirmed real-world exploitation doesn't leave room to wait. Because the flaw hands out admin access and Metabase typically holds live credentials for a production database, treat any instance you find still unpatched as potentially already compromised rather than just closing the hole: rotate the database credentials it was configured with, and check access logs for admin logins or data exports you can't account for. If you set up a client's dashboard but no longer manage the underlying server, a quick heads-up is worth sending regardless — an unpatched BI tool is a fast route from one stolen set of credentials to a much larger breach.