Framework loses customer data in Metabase zero-day attack

Framework, the modular laptop manufacturer that built its reputation on repairability and supply chain transparency, confirmed late Tuesday that a zero-day vulnerability in its self-hosted Metabase business intelligence instance was exploited to exfiltrate customer order data, support tickets, and partial payment metadata. The breach, discovered during a routine log review on Monday, marks the first significant security incident for the company since its 2019 founding and raises uncomfortable questions about the operational maturity of hardware startups that double as direct-to-consumer retailers.

The compromised Metabase deployment — an open-source analytics platform widely used by mid-market companies for internal dashboarding — sat on a Kubernetes cluster in Framework's US-east cloud environment. According to the company's preliminary incident report, attackers leveraged a pre-authentication remote code execution flaw in Metabase's query engine, tracked as CVE-2024-48912, which was privately disclosed to the Metabase maintainers only 72 hours before exploitation began. No public patch existed at the time of the intrusion.

Attack chain

Forensic artifacts reviewed by CRM Today indicate the threat actor enumeration began with a standard Metabase /api/session endpoint probe, followed by a crafted serialized payload that bypassed the platform's middleware authentication wrapper. Once inside the application context, the attacker enumerated the internal H2 metadata database, located the `report_card` and `table` objects backing Framework's order analytics dashboards, and issued a series of `native` query executions that dumped customer records in batches of 5,000 rows — a throttle pattern consistent with evasion of the platform's default query governor.

The exfiltrated dataset includes approximately 340,000 unique customer records spanning Q4 2022 through Q2 2024. Fields exposed: full name, shipping address, email, phone, order SKU, serial number, and the last four digits of the payment card on file. Full PANs, CVVs, and authentication credentials were not stored in the Metabase warehouse, Framework's CTO confirmed. Support ticket contents — including diagnostic logs users voluntarily uploaded — were also accessible via the same query path.

Metabase zero-day context

CVE-2024-48912 is the third critical-tier vulnerability in Metabase's query execution subsystem since 2022. The project, maintained by a small core team backed by Metabase Inc., has historically prioritized feature velocity over hardening. Its architecture — a Clojure/JVM backend exposing a REST API over a PostgreSQL or H2 metastore — presents a broad attack surface when deployed without a WAF or zero-trust proxy. The `/api/native` endpoint, intended for trusted internal tooling, accepts raw SQL with minimal sanitization in versions prior to the unpublished 0.48.7 hotfix.

Framework's deployment ran 0.48.4, pinned to that version to preserve compatibility with a custom metadata sync pipeline built by their internal data team. The pinning decision, documented in an internal RFC from March, explicitly accepted the risk of delayed security updates in exchange for pipeline stability. That calculus now looks like a textbook case of technical debt converting to existential risk.

Operational fallout

Framework's response has been notably transparent — a marked contrast to the industry norm of delayed disclosure and legalistic phrasing. Within four hours of confirmation, the company published a timeline, a data schema of exposed fields, and a commitment to fund two years of identity monitoring for affected customers through a major credit bureau. The support portal was taken offline for 36 hours while the Metabase cluster was destroyed, the Kubernetes namespace rebuilt from Terraform, and a patched Metabase 0.48.7 image deployed behind a Cloudflare WAF with managed rules for the CVE signature.

But the reputational damage is already compounding. Framework's community forums — historically a competitive moat — have filled with calls for SOC 2 Type II attestation, a dedicated AppSec hire, and a bug bounty program. Two enterprise resellers have quietly paused new purchase commitments pending a third-party penetration test. The company's next funding cycle, rumored to target a $500M valuation, will now face diligence scrutiny on data governance, not just unit economics.

Industry signal

The incident illuminates a blind spot in the modern hardware startup playbook. Companies like Framework, System76, and MNTD operate as hybrid manufacturers and SaaS retailers, running bespoke stacks for commerce, telemetry, support, and analytics. They adopt open-source data platforms — Metabase, Superset, PostHog — with the same velocity they adopt CI/CD tooling, but rarely with commensurate security operations. The Metabase zero-day is a wake-up call: any component that touches PII is production infrastructure, not an internal tool, and must be threat-modeled, monitored, and patch-managed accordingly.

Metabase Inc. has since released 0.48.7 and 1.0.0-rc1 with the RCE vector mitigated via a doubled HMAC validation on the native query deserialize path. The project announced a new security email alias and a commitment to coordinated disclosure timelines. For the broader ecosystem, the lesson is blunt: if you run Metabase on a network segment that can reach customer data, you are one undisclosed CVE away from a breach notification letter. Patch velocity is now a product feature.