Critical

Metabase SQLi zero-day exploited in customer data-theft attacks

BleepingComputer

August 7, 2026 at 8:14 PM

Actively Exploited

Overview

A serious SQL injection vulnerability in Metabase has been exploited in zero-day attacks, resulting in unauthorized access to customer data. This flaw has specifically affected companies like Framework and Tally, raising concerns about the security of user information stored in Metabase instances. Attackers have taken advantage of this weakness to steal sensitive data, which highlights the urgent need for affected organizations to address the vulnerability promptly. Users and companies relying on Metabase should be vigilant and ensure their systems are secure against potential breaches. The situation emphasizes the importance of maintaining robust security measures, especially when using widely-used data analysis tools.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Metabase, Framework, Tally
Action Required: Users should apply any available patches from Metabase, review security settings, and implement input validation to mitigate SQL injection risks.
Timeline: Newly disclosed

Original Article Summary

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]

Impact

Metabase, Framework, Tally

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should apply any available patches from Metabase, review security settings, and implement input validation to mitigate SQL injection risks. Regularly updating software and monitoring for unusual activity is also recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Zero-day, Vulnerability, SQLi, and 1 more.

Read Original Article

Related Coverage

Unlimited Technology Systems breach impacts 3.8 million people

BleepingComputer

Unlimited Technology Systems, a healthcare software provider, has reported a significant data breach that has affected over 3.8 million individuals. The breach, which took place in October 2025, has raised serious concerns about the security of personal information in the healthcare sector. While the company has not disclosed specific details about how the breach occurred, the scale of the incident suggests that sensitive data may be at risk. This situation highlights the growing vulnerability of healthcare organizations to cyberattacks, emphasizing the need for robust security measures to protect patient data. Affected individuals may face risks such as identity theft or fraud, making timely notification and support essential.

Aug 7, 2026

Vishing group UNC6671 now focuses on extorting M&A firms

SCM feed for Latest

A vishing group identified as UNC6671 has shifted its focus to targeting mergers and acquisitions (M&A) firms with extortion schemes. This group, known for using voice phishing tactics, aims to exploit sensitive financial data and negotiations occurring in these high-stakes environments. Experts are advising firms to implement managed-device logins and closely monitor audit logs to combat the rising threat of phishing-led data theft. The implications of this shift are significant, as M&A firms often handle large sums of money and confidential information, making them prime targets for attackers seeking to leverage that data for financial gain.

Aug 7, 2026

Zbtlink denies backdoor claims amid firmware download pause

SCM feed for Latest

Zbtlink is facing scrutiny after claims from VulnCheck CTO Jacob Baines, who alleges that Zbtlink routers are designed to communicate with command and control servers, likening this feature to a 'phone-home trojan horse.' This allegation raises concerns about potential security vulnerabilities in Zbtlink products. The company has paused firmware downloads, which could indicate a response to these claims or an effort to address any underlying issues. Users of Zbtlink routers may need to be cautious about their device security and monitor for any unusual activity. The implications of these claims could be significant, as users’ personal data and privacy might be at risk if the allegations are proven true.

Aug 7, 2026

Walmart faces lawsuit over alleged secret voiceprint collection in Illinois

SCM feed for Latest

Walmart is facing a lawsuit in the U.S. District Court for the Northern District of Illinois over allegations that it secretly collects voiceprints from customers who call its stores. The lawsuit claims that Walmart records these calls and extracts vocal characteristics to create mathematical templates that can identify callers in the future. This raises significant privacy concerns, especially regarding how data is collected and used without explicit consent. If the allegations are proven true, it could lead to serious implications for Walmart's operations and customer trust, especially in a time when data privacy is a major concern for consumers. The case could set a precedent for how companies handle customer data in the future.

Aug 7, 2026

More than half of AI-generated patches are broken

CyberScoop

Recent research has shown that more than half of security patches generated by artificial intelligence are likely to fail in fully addressing vulnerabilities. In some cases, these AI-generated solutions may even create new vulnerabilities that attackers can exploit. This raises significant concerns for organizations relying on AI to automate their security measures, as they may inadvertently introduce more risks instead of mitigating them. Companies and security teams should be cautious and verify the effectiveness of AI-generated patches before implementation to prevent potential exploitation. The findings serve as a reminder that while AI can aid in cybersecurity, it should not be solely depended upon without thorough human oversight.

Aug 7, 2026

Crypto thieves increasingly using physical attacks for virtual currency theft

SCM feed for Latest

A new report from Chainalysis reveals a troubling trend where criminals are using physical violence, known as 'wrench attacks,' to steal cryptocurrency from victims. These attacks often involve assailants targeting individuals in their homes or public spaces, demanding access to digital wallets and private keys. This method of theft is particularly alarming because it combines traditional robbery tactics with the growing popularity of virtual currencies. Victims can suffer significant financial losses, and this shift in criminal strategy raises concerns about the safety of cryptocurrency holders. As the market for digital currencies expands, users need to be more vigilant about their physical security and take precautions to protect their assets.

Aug 7, 2026