Cybersecurity

One Metabase Flaw Hit Three Companies at Once

A single unauthenticated SQL injection zero-day in Metabase let attackers hit Framework, Tally and LexisNexis at once. Names, emails, phone numbers and addresses were exposed; payment data was not.

CybersecurityBy Servola Tech Desk2026-08-104 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

One Metabase Flaw Hit Three Companies at Once

Key takeaways

One unauthenticated SQL injection zero-day in Metabase's password-reset endpoint gave attackers admin access and exposed customer data at three unrelated companies at once, Framework, Tally and LexisNexis, none of which had a flaw of their own.
Metabase told Framework on August 6 that an attacker had accessed its instance on August 3; Framework emailed all customers on August 7 confirming names, emails, phone numbers and billing or shipping addresses were exposed, but payment data was not.
The blast radius of a SaaS vendor breach is every customer of that vendor, not just the company whose name ends up in the headline, which is why the real exposure list is longer than any single breach notice will ever say.
The actionable move for any owner is a short inventory: which SaaS and BI tools does your business run, what customer data actually lives in them, and who else on that vendor's client list is now exposed alongside you.

Framework's customers got the email first

On August 7, Framework, the maker of repairable, modular laptops, emailed its entire customer base to say their data had been exposed. The company had learned the day before, on August 6, that an attacker had broken into its Metabase instance on August 3 and pulled customer records. Framework confirmed that names, email addresses, phone numbers, and billing and shipping addresses were taken. Payment information was explicitly not exposed, a distinction Framework drew clearly in its notice.

Framework itself was not hacked in any direct sense. It never touched its own database with a flawed line of code. The company was a customer of Metabase, the business intelligence platform many firms use to query their own operational and sales data, and the attacker went in through Metabase, not through Framework.

The flaw was in Metabase, not in any of its customers

Metabase disclosed a critical, unauthenticated SQL injection zero-day in its password-reset API endpoint. An attacker with no credentials could inject arbitrary SQL against the underlying application database, which was enough to grant them administrator access to a Metabase instance outright. Metabase said the flaw affected its Cloud SaaS product and confirmed active exploitation before it published a fix. Patched versions start at 0.58.24 and run through 0.63.5 and above, covering every supported release line.

This is the detail owners tend to skip past: the vulnerability sat in Metabase's own code, not in how Framework, Tally, or LexisNexis configured their accounts. Every customer running an affected, unpatched instance was exposed the same way, through no fault of their own.

Three companies, one vendor, one afternoon

Framework was not alone. Tally, a forms product, and LexisNexis, the data and legal-research firm, were also hit through the same Metabase flaw. Three companies with nothing in common operationally, serving different markets with different products, ended up notifying customers about the same root cause within days of each other. None of them shared a codebase, a security team, or a vendor relationship with each other. They shared a BI tool.

That is the pattern worth sitting with. A single flaw in a widely used SaaS platform does not produce one breach. It produces as many breaches as that platform has customers with exploitable data sitting inside it, all at once, all traceable to a vendor none of the affected companies' own customers had ever heard of.

What was taken, and what the notice explicitly excludes

Framework's notice is a useful template for reading any breach disclosure. It names four categories taken: names, email addresses, phone numbers, and billing or shipping addresses. It names one category explicitly excluded: payment data. That exclusion matters, but it is not the whole picture. Names, emails, phone numbers, and physical addresses are exactly the raw material for targeted phishing, SIM-swap attempts, and account-takeover attacks elsewhere, even without a single card number in the mix.

Read every breach notice for both lists, what was confirmed taken and what was confirmed not taken, and treat anything unmentioned as unknown rather than assumed safe. A notice that reassures you about payment data has told you nothing about your phone number.

The question every owner should be asking this week

Most businesses can name their bank and their insurer without hesitation. Far fewer can name every SaaS and BI tool that holds a live copy of their customer data, or say with confidence what that vendor's own security posture looks like. Metabase, Salesforce, HubSpot, an analytics dashboard, a support desk platform: each one is a door into your customer list that you do not control and rarely audit.

The practical step is not to abandon SaaS BI tools. It is to make a short list of every vendor with write or read access to customer PII, confirm which ones sit behind multi-factor authentication and patch quickly, and ask each one directly what their incident notification timeline looks like. Framework's customers found out on day four. Plan for your own notice to arrive on a similarly short clock, and decide now, not after the email lands, what you will tell your own customers.

Frequently asked questions

Was Framework itself hacked?

No. Framework was a customer of Metabase, a business intelligence platform. The attacker exploited a flaw in Metabase's own code to access the Metabase instance Framework used, not any system Framework built or controlled.

Which companies were affected by the same Metabase flaw?

Framework, Tally, and LexisNexis have all confirmed they were hit through the same unauthenticated SQL injection zero-day in Metabase. Other Metabase customers running unpatched, affected versions may also have been exposed.

Was payment information exposed?

No. Framework explicitly confirmed payment data was not taken. Names, email addresses, phone numbers, and billing or shipping addresses were exposed.

The headline names Framework, but the exposure list is every Metabase customer who had not patched by August 3. Owners who treat this as a Framework story rather than a vendor-blast-radius story will make the same mistake again with the next SaaS platform that has a bad day, and there will be a next one. The only defense that scales is knowing, in advance, which vendors hold your customer data and how fast they tell you when something goes wrong.

MetabaseFrameworkTallyLexisNexisSQL injectiondata breach

Your MSP's RMM Tool Has a Second Bypass Flaw

CISA confirms active exploitation of CVE-2026-18577, a bypass of N-able's own earlier N-central patch. CVSS 8.2, KEV-listed 3 August, FCEB deadline 6 August.

4 min read

Cybersecurity

The Phone Call That Beats Your Company's MFA

Google traced a vishing campaign that phoned staff at Apollo, Blackstone and KKR, harvesting MFA codes live and netting 10 million dollars in bitcoin.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.