Metabase Zero-Day: Framework & Tally Data Stolen

Sat Aug 08

August 6–7, 2026: Metabase disclosed a CVSS 10.0 unauthenticated SQL injection zero-day that attackers used against Metabase Cloud — and modular laptop maker Framework told all customers that names, emails, addresses, phones and login IPs were stolen from its Metabase instance on August 3. Form builder Tally said the same wave took emails and password hashes from its analytics environment.

If you buy Framework hardware or run Metabase against a warehouse full of customer data, this week’s notices are the same story from opposite ends of the cable.

What happened

Metabase CEO Sameer Al-Sakran published a security update stating that Metabase Cloud was attacked with a previously unknown vulnerability in versions 1.58 and above. The company blocked the attack endpoints, shipped patches, and warned that self-hosted installs were also vulnerable.

The associated GitHub advisory (GHSA-vwf4-m7j8-wcjf) is blunt: an unauthenticated remote attacker can inject arbitrary SQL into the Metabase application database, obtain administrator access, change configuration, steal stored credentials for connected databases, read data through those connections, and export it. Metabase confirmed active exploitation. Cloud tenants were upgraded automatically; everyone else has to patch.

Framework’s customer email — reported by BleepingComputer, TechCrunch and How-To Geek — says Metabase notified the company on August 6 that its instance had been vulnerable and accessed on August 3. Stolen fields included full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers and company names. Framework for Business customers may also have seen VAT, EIN and billing email in the blast radius. Payment cards were not taken, Framework said, and it rotated credentials after the notice.

Tally, the form product at tally.so (not the Indian ERP company of a similar name), told users its Metabase analytics environment was compromised the same day. Attackers reached email addresses and password hashes. Tally emphasised that hashes are one-way and that form answers live elsewhere and were not reached. Which hash algorithm, and whether salts were used, was still unanswered publicly when BleepingComputer asked.

LexisNexis separately emailed customers about unusual activity on third-party-hosted servers and disconnected Diligence, Metabase API and Newsdesk while investigating — a disruption in the same news cycle, with customer-data exposure not yet confirmed.

Timeline

August 3, 2026 — Attackers access Framework’s Metabase instance; Tally’s Metabase analytics environment also compromised per company notices.
August 6 — Metabase publishes the Cloud zero-day advisory and patch guidance; Framework notifies customers after Metabase’s alert.
August 7 — Trade press (BleepingComputer and others) ties Framework, Tally and LexisNexis service disruption into one exploitation wave.

How the Metabase attack worked

This was not “someone phished an accountant and got a spreadsheet,” which is how Framework’s 2024 breach happened. This is application-layer compromise of the BI tool that sits on top of the databases you actually care about.

Metabase’s own hunt guidance is a two-step fingerprint: a POST /api/session/reset_password that returns 400, followed by a successful GET /api/user/current. If that pattern is in your ingress or app logs, treat the instance as owned. From admin, the attacker does not need your laptop fleet — they need the warehouse credentials Metabase stored so analysts could chart revenue.

That is why a “analytics” breach becomes a customer-PII breach. Framework did not have to expose a production e-commerce database directly to the internet. It had to give Metabase enough access to answer business questions. The zero-day turned that trust into an export pipe.

What was exposed (and what was not)

Framework: identity and contact data for customers — names, emails, phones, shipping/billing addresses, login IPs, company names; business tax identifiers for Framework for Business. Not payment cards, per the company.

Tally: emails and password hashes. Not form submissions, per Tally.

Metabase Cloud tenants generally: whatever each customer’s Metabase could reach after admin takeover. That is why Metabase’s remediation list starts with revoke sessions, delete unknown API keys, review admins, rotate connected database credentials, and inspect warehouse logs — not “change your laptop password.”

Framework has not published a headcount. “All customers” is the operational statement. Until a regulator filing or a later letter gives a number, treat every Framework order email as in-scope for phishing.

Who is at risk

Framework customers — DIY builders and Framework for Business buyers alike. Expect scams that quote a real shipping address or order context.

Tally users — especially anyone who reused the Tally password on email or banking. Hash theft is not “password stolen in plaintext,” but offline cracking is real if the algorithm is weak or unsalted.

Every self-hosted Metabase shop still below the patched point releases — you are not waiting for a branded customer email. You are the next export if the endpoint is still reachable.

Companies that pointed Metabase at production replicas “just for a week” — temporary access has a way of becoming permanent connectivity with permanent credentials.

What you should do

Framework buyers: watch for phishing that uses your real name and address. Do not pay “customs” or “reship” fees from a link. Change passwords you reused with the Framework account email.
Tally users: change your Tally password from a clean device, enable MFA, and assume the old password is burned everywhere it was reused.
Metabase Cloud customers: confirm you are on the auto-patched build; still rotate connected DB credentials and review query history for odd exports.
Self-hosted Metabase: upgrade to the minimum safe point release for your branch (Metabase lists floors such as 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5). If you cannot patch immediately, restrict /api/session/reset_password.
After upgrade: delete core_session rows (revoke sessions), audit API keys and admin accounts, rotate warehouse passwords, and hunt the 400-then-200 attack pattern in logs.
Security teams: inventory every BI tool with live credentials to production-like data. Metabase is not unique — Looker, Superset, Redash and homegrown admin panels have the same trust shape.
LexisNexis Diligence / Newsdesk customers: track LexisNexis’s follow-up; disruption is confirmed, data theft is not (yet).

Why this Framework data breach matters beyond one laptop brand

Framework’s brand is repairability and transparency. That does not immunise the SaaS tools in its back office. The 2024 Keating phishing incident already showed third-party risk; the 2026 Metabase event shows product-risk inside the analytics tier. Different root causes, same lesson: customer PII often lives one JOIN away from a dashboard.

For the wider industry, a CVSS 10 unauthenticated SQLi in a popular open-source BI stack is a supply-chain event even when the vendor is not an npm package. Thousands of companies self-host Metabase precisely because it is easy. Ease is why the attack surface was worth a zero-day.

Expect more victim notices. Framework and Tally spoke early. Other Metabase customers may still be reading logs.

Industry context

August 2026 already had identity-heavy health breaches and ransomware listings. This campaign is different: it is a single application flaw turning BI admins into data exporters. Compare it to other zero-day-driven data thefts against enterprise apps — the pattern is “authenticate as god, then SELECT *,” not encrypt-and-extort.

Self-hosted open source does not mean you are off the vendor’s incident clock. When Metabase Cloud is hit, the same binary is what you run in Docker. Patch Tuesday for community software is whenever the advisory drops.

Patch math for self-hosted Metabase

Metabase ships many supported branches at once. The advisory’s safe floors (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 and whatever supersedes them by the time you read this) mean “latest on your major/minor,” not “jump to bleeding edge without a backup.” Take a snapshot of the application database before you upgrade. Afterward, prove the reset_password fingerprint is gone from new logs and that old sessions cannot be reused.

If Metabase is exposed to the internet without SSO, you are betting the next zero-day will also be polite enough to come with a blog post. Put it on a VPN or reverse proxy with allow-lists. Internet-wide scanners will bang on /api/session/* whether or not you are famous.

Rotate every warehouse user Metabase knew about — not only the password you remember typing last year. Shared “readonly_bi” accounts that also have write access show up constantly in post-incident reviews. This week is a good excuse to split them.

Phishing playbook that will follow Framework’s notice

Expect three flavours. First, shipping scams that quote a real city and street from the dump. Second, “Framework warranty / accidental damage” fees. Third, fake job or influencer outreach aimed at people whose emails appear in DIY communities and now in a breach corpus. None of those need a credit card from Metabase to work.

Framework’s own status and support channels are the only safe places to validate an order. If a message creates urgency measured in minutes, it is almost certainly fake. Real logistics problems wait for business hours.

Tally hashes and the offline-cracking reality check

Modern password hashing can make a dump expensive to crack. Legacy or misconfigured hashing can make it trivial. Until Tally publishes the algorithm and salt details, defenders should assume motivated attackers will try. Unique passwords confine the damage to Tally. Recycled passwords turn one analytics breach into a multi-site account takeover campaign.

Teams that used Tally for internal HR or security questionnaires should also ask whether those forms’ metadata (who was invited, which emails exist) is enough to craft spear-phish against employees even if answers stayed safe.

LexisNexis: disruption without a body count — yet

Disconnecting Diligence, Metabase API and Newsdesk was the correct containment move if a vendor estate looked hostile. Customers should still demand a clear later statement: was data accessed, which products, which date range? “We took systems offline” is not a privacy notice. BreachHistory will update the LexisNexis row when that sentence arrives.

Patch cadence and disclosure delay

Framework’s customers learned on August 6 about access on August 3. Those seventy-two hours are when exported CSVs leave the building and land in tooling you will never see. Metabase’s Cloud customers were patched centrally; Framework still had to learn it was a victim. That dual clock — vendor control-plane fix versus customer forensic notice — is the uncomfortable reality of SaaS analytics.

Organisations that mirror production PII into Metabase “just for QBR charts” compress that clock into a single failure. If the BI tool can answer “list every shipping address,” it can answer that question for an attacker with admin. The fix is data minimisation in the warehouse connection, not a stern password policy on the dashboard login alone.

Open-source popularity amplified the blast radius. Metabase’s docs and Docker one-liners put thousands of instances online with similar shapes. Attackers did not need a Framework-sized brand to justify a zero-day; Framework simply proved the exploit converts into consumer notice letters.

Checklist for CISOs this week

Find every Metabase (and lookalike BI) instance, Cloud or self-hosted.
Patch or isolate; hunt the reset_password fingerprint.
Rotate connected database secrets and invalidate sessions.
Review egress logs for large result exports around August 3–6.
Draft customer language now if you store shipping PII in BI.
Add “analytics tier compromise” to the tabletop library beside ransomware.

One more practical note for home-lab and SMB operators: if your Metabase container still has the default admin from a tutorial, you were already one credential dump away from disaster before this zero-day. Pair the emergency patch with a privilege review. Delete unused databases from the Metabase UI so a future admin session cannot reach them. And stop pointing weekend experiments at production replicas — that habit is how “analytics” becomes tomorrow’s breach letter.

Framework vs Tally: two different data shapes

Framework’s loss is classic commerce PII — enough to run convincing delivery and warranty scams without card numbers. Tally’s loss is credential material. Even with one-way hashes, a large email+hash dump is gasoline for credential stuffing against other sites if users recycled passwords. That is why Tally’s “hashes can’t be reversed” sentence is true and incomplete at the same time.

If you used a unique password manager entry for Tally, you are in better shape than someone who used the same password as their Google account. If you do not remember, assume the worse case and rotate.

Hardening BI tools after this week

Put Metabase (and peers) behind SSO with phishing-resistant MFA. Disable public reset endpoints where you can. Prefer private networking to warehouses over credentials stored in the BI app when your platform allows it. Log and alert on bulk exports and on new admin creation. Keep a cold list of which dashboards touch production PII so incident response does not start with archaeology.

Contractually, ask SaaS BI vendors how fast they will email you when their Cloud control plane is under active exploitation — Framework learned on August 6 about an August 3 access. Those three days are when attackers copy data and defenders still think the dashboard is healthy.

What “all customers” means for Framework phishing

When a company notifies everyone, scammers also get a target list: anyone who has ever posted a Framework unboxing is worth an email. The tell will be urgency plus a parcel problem. Framework will not ask you to “re-verify payment” through a fresh domain. Open the official site yourself.

Canonical records

Sources: Metabase security update, GHSA-vwf4-m7j8-wcjf, BleepingComputer, TechCrunch.

Published 2026-08-08. Will update when Framework or Tally publish headcounts or LexisNexis confirms or rules out data exposure.