A critical unauthenticated SQL injection zero-day vulnerability in Metabase versions 1.58 and above has been actively exploited in attacks targeting customer data, impacting both Metabase Cloud and self-hosted instances. The flaw allows remote attackers to gain administrator access, steal credentials, and exfiltrate data, with confirmed breaches reported by companies including Framework and Tally. Metabase has released patches and urges users to update immediately, revoke sessions, rotate credentials, and monitor for signs of compromise.
https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/