Zero-Day Exploitation and Automated Scans Drive Spate of Data Breaches Across Metabase Deployments
A wave of intrusions targeting the open-source business intelligence platform Metabase has led to widespread data breaches across multiple tech organizations and SaaS providers. The underlying flaw, tracked as `CVE-2026-72898`, allows remote attackers to bypass the platform's authentication mechanisms via an exposed API endpoint. According to incident timelines, exploitation began in the wild as a zero-day around August 3, hitting organizations like Framework and Tally before public disclosures were made. Metabase maintainers initially disclosed the issue and pushed out patches on August 6, before hardened releases incorporating API-level reinforcements rolled out shortly thereafter. By August 10, exploitation templates were integrated into the public scanner `Nuclei`, leading to massive automated scanning across exposed instances globally and catching services like Scalingo. National incident response teams stepped in to notify vulnerable operators, with India's CERT warning Dodo Payments on August 16 and French authorities alerting operator TeleCoop by August 19. TeleCoop confirmed that attackers had bypassed its authentication system between August 18 and August 19 to exfiltrate data, patching only after official warnings. A broad set of organizations suffered impacts from the fallout, including TimeTonic, Dipeeo, Shipup, Tixel, and the public platform Zéro Logement Vacant. Hosting provider Clever Cloud acted quickly on August 7 to block the vulnerable API endpoint directly at the infrastructure level to protect its tenant fleet. However, infrastructure-level mitigations and late patching could not remediate instances where threat actors had already established unauthorized administrative access prior to the block.
Commentary
This incident showcases the messy reality of patching business intelligence systems. When tools like Metabase sit exposed directly to the public internet, a simple authentication bypass on an API endpoint essentially grants complete, structured access to all underlying corporate databases. What makes `CVE-2026-72898` particularly lethal is the persistence problem. Once an attacker bypasses authentication on a BI tool, patching the vulnerability or putting a reverse proxy rule in front of the vulnerable API endpoint is insufficient. Attackers frequently create secondary admin accounts, generate valid API keys, or export saved database credentials during the initial compromise. The fact that platforms reported breaches well after fixes were deployed suggests that threat actors retained access long after the front door was locked. Any team hosting Metabase must immediately update past the August hardened releases. Beyond applying software updates, incident responders must audit all Metabase user tables, rotate every database credential configured within Metabase data sources, revoke existing user session tokens, and lock down the platform behind an identity-aware proxy (IAP) or VPN rather than exposing query dashboards directly to the internet.
The Quote to Remember
“between August 18 and 19, third parties bypassed the authentication mechanism”
“which incorporate several security enhancements, notably the hardening of our API and the correction of issues arising from the vulnerability we discovered last week”