Metabase SQL Injection Zero-Day Data Theft Campaign

Technical Analysis

The vulnerability resides in Metabase's query handling layer, allowing attackers to inject malicious SQL through crafted requests to extract data from connected databases without valid authorization, effectively bypassing Metabase's permission model. Exploitation appears to have occurred prior to public disclosure or patch availability, characteristic of zero-day abuse, with attackers targeting hosted or self-managed Metabase instances that expose data-source connections to production or customer databases. Because Metabase is frequently connected to production data warehouses containing customer PII, transaction records, and application metadata, successful exploitation grants attackers broad read access to that underlying data. Organizations running AI agents or RAG pipelines that use Metabase-connected databases as a knowledge or analytics source are at risk of exposing sensitive data through compromised query results, and any API keys or database credentials stored in Metabase's connection configs could be harvested and reused to attack downstream agent tooling. This elevates the incident's relevance for agent-integrated data stacks beyond typical BI-tool compromises.

Affected Systems

Metabase self-hosted and cloud-hosted instances with SQL query/question features enabled; specific affected versions not yet disclosed by vendor. Confirmed impacted deployments belong to Framework and Tally customer environments.

Indicators of Compromise

• Not yet publicly disclosed; monitor vendor and BleepingComputer updates for indicators (malicious query patterns, anomalous API access logs, unexpected outbound data transfers from Metabase hosts).

Remediation Steps

1. 1

   Apply vendor patch immediately

   Monitor Metabase's official security advisories and apply the patched version as soon as it is released.

2. 2

   Restrict Metabase network exposure

   Limit Metabase instance access to internal networks or VPN, and disable public internet exposure of admin/query interfaces.

3. 3

   Audit database connection permissions

   Review and minimize the privileges of database accounts connected to Metabase to enforce least privilege and limit blast radius of SQLi exploitation.

4. 4

   Rotate credentials and API keys

   Rotate database credentials, service account keys, and any API keys accessible via Metabase configuration, especially those used by downstream AI agents or automation pipelines.

5. 5

   Review query and access logs

   Audit Metabase query logs for anomalous or malformed SQL queries indicative of injection attempts, and correlate with data egress logs.

6. 6

   Notify and monitor affected customers

   Organizations using Framework or Tally should proactively monitor for signs of data misuse and follow breach notification guidance from those vendors.