Metabase's 10.0 Bug Burned Framework, Tally and Trezor

Metabase shipped a 1998 bug in a box holding everyone’s database keys

Read the scoring first, because it is the whole story. CVE-2026-72898: CVSS 10.0 out of 10. The maximum. No password needed, no user interaction needed, remote, and it hands over administrator access.

The flaw is a SQL injection — typing database commands into an ordinary web form and having the software run them instead of treating them as text. NIST’s National Vulnerability Database files it as CWE-89, the textbook entry. That bug class was named in 1998 and has sat near the top of the OWASP Top Ten for two decades.

Metabase is a business intelligence tool. Companies point it at their own databases to build charts and dashboards. To do that, it stores the credentials for those databases. It is, by design, a box holding the keys to everything.

The way in was the password-reset endpoint. Affected builds run from 0.58.0 to 0.63.4 open source, and 1.58.0 to 1.63.4 enterprise.

The timeline nobody comes out of well

Attackers were exploiting it on 3 August, before a patch existed — a zero-day, meaning the vendor had zero days’ warning. Metabase notified affected customers on 6 August. Public disclosure followed on 7 August.

CISA, the US cyber defence agency, added it to the Known Exploited Vulnerabilities catalog on 11 August and gave federal agencies until 14 August to fix it. Three days. CISA does not issue three-day deadlines for theoretical risk.

By then the bill had already landed on companies that never heard a shot fired: Framework, Tally, Anaconda, n8n, Kilo Code, and the logistics firm ShipMonk — and through ShipMonk, Trezor’s customers.

Framework told everyone they were breached, then would not say how many

Framework makes repairable laptops and has built a real reputation on treating its users well. That reputation took a hit.

The company emailed customers on 6 August confirming that names, email addresses, phone numbers, physical addresses and login IP addresses were accessed. Payment details were not. Asked how many people that covers, spokesperson Eric Schumacher told TechCrunch it was “all customers” — and declined to give a number.

Two failures, and the second is the avoidable one.

First: ask why a laptop company’s analytics tool held customers’ home addresses and login IPs at all. That is a data minimisation problem, and it is the difference between a leak and a catastrophe. Data you never collected cannot be stolen.

Second: “all customers” is not a disclosure, it is a shrug. Framework knows the number. Every affected person now has to assume they are in it, which is exactly the anxiety a real figure would have settled. Tally, hit through the same bug, lost email addresses and password hashes.

Reported by TechCrunch and BleepingComputer.

Trezor was hit at the third hop and handled it the way everyone should

Trezor makes hardware wallets — the small devices that keep cryptocurrency keys offline. Trezor did not use Metabase. Trezor’s shipping partner ShipMonk did. When ShipMonk fell, Trezor’s order records went with it.

Then Trezor did what the rest of this story conspicuously lacks. It published exact figures: 13,689 customers affected, split into 11,742 who lost names, addresses, emails and phone numbers, and 1,947 who lost names, cities and emails. It named the countries — US, UK, Sweden, Colombia, Brazil, Italy, Portugal. It named the order window, 10 May to 8 August. It confirmed its own systems and devices were untouched, and it emailed every affected person individually.

Notified 10 August, public 13 August, with real numbers and correct advice. Credit where it is due, and Framework should read it.

The danger is severe and Trezor said so plainly: criminals now hold a verified list of people who own crypto hardware wallets, with home addresses attached. Expect extremely convincing fake security alerts.

Disclosed by Trezor.

What This Means For You

If you bought from any of these companies: you did nothing wrong and there was nothing you could have done. Framework’s customers did not pick Metabase. Trezor’s customers did not pick ShipMonk. The decisions that exposed you were made in rooms you will never see.

What you control is what happens next. This kind of leak feeds phishing that works precisely because the sender genuinely knows your name, your address and what you bought. Treat any unexpected security alert as fake until you have checked it yourself by typing the company’s address into your browser rather than clicking anything. And no legitimate company will ever ask for your crypto recovery phrase — not support, not a firmware update, not a letter. Anyone who asks is stealing from you.

If you run or work for an organisation: patch Metabase now if you self-host it — 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5. Then do the part nobody schedules. Write down every outside company that can currently read your customer database, and next to each one write what happens the day it is breached. If you cannot finish that list, you do not know what you would have to disclose, and you will be the next company saying “all customers” because you genuinely do not know the number.

Start with what you hold and why: what is data security covers the fundamentals, and most of the damage here came from fields nobody needed to keep.

The verdict: “we were downstream” is not the exoneration companies keep treating it as. Somebody at each of these firms chose to hand a third-party cloud tool live credentials to the customer database. That was a choice, and it is still a choice today. This is what a supply chain attack looks like when it works.