#Data-Breach

Zero-Day Exploitation and Automated Scans Drive Spate of Data Breaches Across Metabase Deployments

A wave of intrusions targeting the open-source business intelligence platform Metabase has led to widespread data breaches across multiple tech organizations and SaaS providers. The underlying flaw, tracked as `CVE-2026-72898`, allows remote attackers to bypass the platform's authentication mechanisms via an exposed API endpoint. According to incident timelines, exploitation began in the wild as a zero-day around August 3, hitting organizations like Framework and Tally before public disclosures were made. Metabase maintainers initially disclosed the issue and pushed out patches on August 6, before hardened releases incorporating API-level reinforcements rolled out shortly thereafter. By August 10, exploitation templates were integrated into the public scanner `Nuclei`, leading to massive automated scanning across exposed instances globally and catching services like Scalingo. National incident response teams stepped in to notify vulnerable operators, with India's CERT warning Dodo Payments on August 16 and French authorities alerting operator TeleCoop by August 19. TeleCoop confirmed that attackers had bypassed its authentication system between August 18 and August 19 to exfiltrate data, patching only after official warnings. A broad set of organizations suffered impacts from the fallout, including TimeTonic, Dipeeo, Shipup, Tixel, and the public platform Zéro Logement Vacant. Hosting provider Clever Cloud acted quickly on August 7 to block the vulnerable API endpoint directly at the infrastructure level to protect its tenant fleet. However, infrastructure-level mitigations and late patching could not remediate instances where threat actors had already established unauthorized administrative access prior to the block.