Metabase Zero-Day: Tally and Framework Breaches Explained

Quick Answer

CVE-2026-0768 Metabase zero-day SQLi exploited by ShinyHunters in 2026. Affected: Tally (form builder), Framework (laptop maker), ShipMonk (3rd party in Trezor/ShipMonk breach). Patch released. Mitigation: update Metabase, restrict network access, enable auth, WAF (BleepingComputer, 2026).

Data last verified September 2026 from BleepingComputer, CISA, and Metabase security advisories.

The Metabase zero-day campaign

The Metabase zero-day was part of a coordinated campaign by the ShinyHunters extortion group. The campaign exploited the same SQLi vulnerability across multiple companies: (1) ShipMonk — fulfillment provider, initially breached May 2026 (affected 14,000 customers, then expanded to 81,000), (2) Tally — online form builder, breached June 2026, (3) Framework — modular laptop maker, breached July 2026, (4) Various other companies. The ShinyHunters group has been active since 2020 and is known for high-profile breaches of Snowflake customers in 2024 (BleepingComputer, 2026).

What is CVE-2026-0768?

Source: CISA, NIST NVD, Metabase security advisory (2026).

Affected companies and breach details

ShipMonk

• Discovery: August 13, 2026 (initial disclosure)
• Affected customers: 14,000 initially, expanded to 81,000 by September 7
• Data exposed: names, email addresses, phone numbers, shipping addresses, order numbers
• Attack vector: ShipMonk used self-hosted Metabase instance exposed to internet
• Data customers affected: Trezor (cryptocurrency hardware wallet maker)

Tally

• Discovery: June 2026
• Affected customers: Approximately 1M+ Tally users (form submissions)
• Data exposed: form submission data, including user emails, names, and form content
• Attack vector: Tally used self-hosted Metabase instance to analyze form submission data

Framework

• Discovery: July 2026
• Affected customers: Approximately 100,000+ Framework laptop buyers
• Data exposed: customer names, emails, shipping addresses, order details
• Attack vector: Framework used self-hosted Metabase instance for customer analytics

Metabase market and adoption

Metabase is widely adopted: (1) 50,000+ companies use Metabase (per Metabase Inc.), (2) Self-hosted instances are deployed by companies of all sizes, (3) Cloud-hosted Metabase is also available. The wide adoption makes Metabase vulnerabilities high-impact, as a single vulnerability can affect thousands of companies. Metabase is particularly popular for: (1) Startup analytics, (2) Self-service BI for non-technical users, (3) Embedded analytics in SaaS products, (4) Customer-facing dashboards (Metabase Inc., 2026).

How the ShinyHunters campaign worked

The ShinyHunters campaign exploited Metabase SQLi in 4 phases: (1) Reconnaissance — scan internet for exposed Metabase instances, (2) Exploitation — exploit SQLi to extract data from the Metabase application's database, (3) Lateral movement — use extracted credentials to access other systems (cloud storage, internal apps), (4) Extortion — threaten to leak or sell the data unless ransom is paid. The ShinyHunters group has been linked to several high-profile breaches and is one of the most active cybercriminal groups in 2025-2026 (Cybersecurity Dive, 2026).

Metabase security best practices

1. Update Metabase to the latest patched version immediately.
2. Never expose Metabase to the internet without authentication.
3. Use VPN or zero-trust network access for Metabase access.
4. Enable Metabase's built-in authentication (LDAP, SAML, Google OAuth, etc.).
5. Use a web application firewall (WAF) like Cloudflare or AWS WAF in front of Metabase.
6. Monitor Metabase logs for unusual query activity (especially for SQL keywords like 'SELECT', 'UNION', 'INSERT').
7. Implement network segmentation to prevent lateral movement from a compromised Metabase instance.
8. Regularly audit self-hosted applications for vulnerabilities.
9. Use Metabase's built-in row-level security and column-level security to limit data access.
10. Backup Metabase application data and the underlying database regularly.

How to detect Metabase compromise

• Unusual SQL queries in Metabase logs (especially for sensitive tables).
• Login attempts from unusual IP addresses.
• High volume of data downloads from the underlying database.
• New Metabase admin users not authorized by your team.
• New Metabase data sources or connections not authorized by your team.
• Unusual Metabase API activity.
• Outbound data transfers to unknown destinations.

What to do if you use Metabase

1. Check your Metabase version. If below 0.49.3, update immediately.
2. Audit your Metabase instance for signs of compromise (unusual queries, admin users, data downloads).
3. Check whether your underlying database (PostgreSQL, MySQL, etc.) has been accessed beyond the Metabase application's normal queries.
4. Notify affected customers if you store customer data in the database accessible via Metabase.
5. Report the incident to CISA, the FBI, and applicable regulators (depending on jurisdiction).
6. Engage an incident response firm to investigate and remediate.
7. Implement the security best practices above.

What this means for self-hosted software security

The Metabase zero-day campaign highlights the risks of self-hosted software: (1) Self-hosted software is only as secure as the operator's configuration, (2) Internet-exposed instances are easy targets for attackers, (3) Vulnerabilities in widely-used open-source software can affect thousands of organizations, (4) Detection and patching can be slow for self-hosted software, (5) Cloud-hosted alternatives often have better security defaults and faster patching. Organizations using self-hosted software should: (1) inventory all self-hosted applications, (2) ensure they are not internet-exposed unnecessarily, (3) patch promptly when vulnerabilities are disclosed, (4) monitor for unusual activity (CISA, 2026).

Resources and next steps

Visit CISA.gov for the latest cybersecurity advisories. The Metabase project publishes security advisories at metabase.com/security. The ShinyHunters group has been tracked by Cybersecurity Dive, BleepingComputer, and KrebsOnSecurity. For vulnerability scanning tools, use Tenable Nessus, Qualys, or open-source OpenVAS. For incident response, consider CrowdStrike, Mandiant, or other IR firms. For WAF protection, use Cloudflare, AWS WAF, or Azure WAF.