metabase

2 articles · newest first

One free BI tool had a password-reset bug that handed out admin — hackers found it first

A single API endpoint let anyone become an administrator on thousands of self-hosted Metabase servers, and Framework, n8n and Kilo Code already got hit before the patch even shipped.

Priya Nair · 5d ago · 7 min

A Framework laptop, the computer maker that disclosed a data breach tied to a Metabase zero-day vulnerability

Software

framework just told every customer their data leaked — the bug was a password reset box

A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.

Priya Nair · Aug 9 · 6 min