Metabase Zero-Day Attacks Expose Customer Data at Framework, Tally and Kilo Code

Metabase is an open-source business intelligence platform widely used to connect corporate databases and build analytics dashboards. The exploitation of CVE-2026-72898 as a zero-day is significant because compromised deployments can give attackers unauthorized access to data centralized for reporting, turning a trusted analytics tool into an entry point for breaches across technology companies and online services.

Recent attacks affected laptop maker Framework, online form platform Tally and AI coding assistant provider Kilo Code. Investigations found that exposed records primarily contained customer names and email addresses. As of Aug. 11, 2026, there was no indication that payment information had been compromised, while the affected companies continued reviewing the scope of unauthorized access and the data held in their Metabase instances.