🟠 High | Source: The Register — Security
Framework Computer, maker of modular repairable laptops, suffered a data breach after attackers exploited a zero-day vulnerability in Metabase, a popular open-source business intelligence tool used by their accounting partner. Customer personal details were exposed as a result. The incident highlights the risk posed by third-party software vulnerabilities in supplier and partner environments.
Security Architect’s Take: Audit your supply chain and third-party partners for exposed Metabase instances immediately — check for the relevant CVE patches and ensure Metabase is not publicly accessible without strong authentication. More broadly, review what customer data partners can access and enforce data minimisation contractually and technically.
Original advisory: Framework loses customer data in Metabase zero-day attack