Framework Data Breach Linked to Metabase Zero-Day Vulnerability
Framework, a company based in San Francisco that designs repairable and upgradeable laptops, has reported a data breach resulting from the exploitation of a zero-day vulnerability in the Metabase business intelligence service. According to a notification sent to affected customers, attackers accessed sensitive information including names, email addresses, phone numbers, physical addresses, and login IP addresses. However, payment information and order records were not compromised.
The breach was confirmed by Metabase, which notified Framework that the attackers had gained access to its cloud instance. In response, Framework has rotated the credentials for the databases linked to its Metabase instance and has not found evidence of a broader compromise at this time. Customers are advised to remain vigilant for phishing emails that may impersonate the company.
Additionally, Belgian company Tally and Kilo Code, an AI coding platform owned by Anaconda, also reported that their customer data was accessed through Metabase. Tally's data breach involved email addresses and password hashes, while Kilo Code's breach included names, emails, and Slack access tokens, which have since been invalidated.
On August 6, 2026, Metabase disclosed that the attack was executed via a zero-day SQL injection vulnerability, which has not yet been assigned a CVE number. This critical vulnerability allows unauthenticated remote attackers to inject arbitrary SQL into the Metabase application database, potentially granting them administrator access. Such access could enable attackers to alter application configurations, steal stored credentials, and read or export data.
The vulnerability affects Metabase versions 58 and above. Metabase has released fixes for the affected versions and has advised customers who self-host to upgrade to a patched version, revoke active sessions, review API keys and admin accounts, and rotate credentials. They also recommend reviewing data warehouse logs for unauthorized access and examining Metabase activity for any unexpected actions.
For those unable to upgrade immediately, Metabase suggests temporarily blocking the /api/session/reset_password endpoint to mitigate risks. The company has outlined the attack pattern, indicating that specific API calls may signal a compromised instance, urging users to check their application logs for these indicators.
