Metabase disclosed this week that a maximum-severity SQL injection flaw in its business intelligence software was exploited in the wild before a patch existed. The vulnerability let an attacker query connected databases directly, no login required, and Framework and Tally have both confirmed customer data was taken from their hosted Metabase instances. Metabase's advisory frames the fix as a routine update. The exploitation timeline it discloses alongside that advisory shows attackers were already inside customer databases before the CVE existed to name what was happening.

Business intelligence tools sit on live database credentials by design, which is what makes an unauthenticated SQL injection there worse than the same bug in a marketing site. Framework and Tally are the first named victims. They will not be the last, because Metabase instances are dashboard products, and dashboards get exposed to the internet by teams who never expected a login page to hide a SQL parser underneath. The control that would have stopped this was network segmentation between Metabase and its underlying databases, not a faster patch cycle. Check whether that segmentation exists before Monday standup.