Metabase, maker of an open-source data analytics tool, has disclosed that cybercriminals exploited a previously unknown security vulnerability to gain access to customer instances. The flaw is tracked as EUVD-2026-55690 and CVE-2026-72898 and carries the maximum CVSS score of 10.0.
Maximum severity, already actively exploited
Metabase describes the flaw as a SQL vulnerability in Metabase Cloud, affecting Enterprise versions 1.58 and later. The vendor rated it maximally critical from the start, immediately blocked the endpoints used in the attack, and identified and fixed the root cause. Cloud customer instances have already been updated and patched, but self-hosted systems may still be vulnerable. CISA added the vulnerability to its KEV catalog on August 11, 2026, and active attacks are already underway.
The SQL zero-day can be exploited without authentication and can even grant attackers administrator access to vulnerable customer instances. That would let them change the application configuration, steal stored credentials for connected databases, and read and export data accessible through those connections.
Affected versions and protective measures
The vendor has since secured all affected branches of the open-source edition from 0.58 through 0.63. Versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 are considered safe. If you self-host Metabase, you should update to one of these versions immediately. Metabase also recommends ending all active user sessions, checking API keys and administrator accounts for unauthorized changes, rotating credentials for connected databases, and reviewing logs and query history for signs of compromise. Anyone who can't update right away should temporarily block access to the "/api/session/reset_password" endpoint. One sign of an ongoing attack: a POST request to that endpoint returns status code 400, followed by a successful GET request to "/api/user/current".
Customers of notebook maker Framework affected
According to reports, customers of notebook maker Framework in particular were affected by the incident. Attackers were reportedly able to view customers' full names, email addresses, login IPs, billing and shipping addresses, phone numbers, and company names. No further personal data or order and payment information is said to have been exposed. Framework says attackers exploited the zero-day flaw as early as August 3, and Metabase informed the company about it on August 6. Form builder Tally and information services provider Lexisnexis have also notified their users about the incident at the third-party vendor.