Metabase published the advisory and the patches on August 6. Mathspace was breached on August 10, the data left on August 27, and the patch went on August 29 — 15 days after the federal deadline for the same flaw had already passed.
What happened
Mathspace, an online mathematics platform used by schools in Australia and New Zealand, published a breach disclosure on September 5, 2026 and updated it on September 8. It began notifying affected individuals directly on September 6. The company says 1,079,819 students, parents, guardians, and school staff had personal information downloaded by an attacker.
The cause, in Mathspace’s own words: “Attackers exploited a security vulnerability in our self-hosted installation of Metabase, software we use for internal reporting.” The company adds that “The vulnerability allowed attackers to obtain administrator access to that system without a legitimate login.”
Mathspace’s timeline is unusually specific, which is to its credit and is also the reason this story exists. Metabase published a critical security advisory and patched builds on August 6, 2026. Unauthorized access to Mathspace’s Metabase instance began on August 10. Data was downloaded from the Australian reporting database on August 27. Mathspace updated its Metabase installation on August 29. The breach was confirmed on September 3 and Metabase was taken offline. Schools and regulators were notified on September 4, and individual notifications began on September 6.
The exposed fields, as Mathspace lists them, are “user ID, username, first name, last name, email address, country, time zone, user type, email-verification status, last-active date, last-login date and date joined.” The company states that “No academic records, learning activities, results, assessment records, passwords (hashes), authentication tokens, SSO credentials, or API credentials were exposed.”
Regulators notified: the Office of the Australian Information Commissioner, the Australian Signals Directorate’s Australian Cyber Security Centre, New Zealand’s Office of the Privacy Commissioner, New Zealand’s National Cyber Security Centre, and Australian state and territory education departments.
Mathspace does not name a CVE. The flaw is CVE-2026-72898. NVD’s description reads: “Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the ‘/reset_password’ database endpoint and gain administrator access to the connected Metabase instance.” NVD scores it 10.0 critical on both CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0. The record was published on August 10, 2026 — four days after Metabase’s advisory, and the same day the intrusion at Mathspace began.
CISA added it to the Known Exploited Vulnerabilities catalog with a cisaExploitAdd of 2026-08-11 and a cisaActionDue of 2026-08-14: a three-day clock under BOD 26-04. The required action reads, verbatim, “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s ‘Forensics Triage Requirements.’”
Two things in the record do not line up, and both are worth stating plainly. First, Metabase’s own GitHub advisory, GHSA-vwf4-m7j8-wcjf, published August 6, 2026, still carries “No known CVE” in its CVE field — for a flaw that has been in KEV since August 11 with a federal deadline that has come and gone. Second, the version ranges disagree. Metabase’s advisory lists the v63 line as affected at “>= 63.0, < 63.3" while naming 63.5 as the patched build, which leaves 63.3 and 63.4 in neither column. NVD lists 0.63.0 through 0.63.4 as affected, closing the gap the vendor left open. Anyone reconciling a fleet against the vendor page rather than the CVE record gets a different answer for two builds.
Metabase’s own postmortem adds that a customer reported unauthorized API key creation on August 3 — three days before the patch — so this was exploited before it was disclosed. Metabase states that “Under 3% of our cloud customers were compromised” before patching, alongside an unspecified number of open-source and self-hosted users with publicly reachable instances. Mathspace was one of the latter.
Why it matters
The number that will travel is 1,079,819. The number that should is 23 — the days between the vendor advisory and the patch going on. Every other date in this story sits inside that window. The intrusion started on day four. The data left on day 21. The patch arrived on day 23, six days after the attacker was already gone.
Put the federal band next to it. For a US federal civilian agency, CISA’s deadline on this same CVE was three days, and it carried a forensic triage obligation on top of remediation: fix it, and then determine whether you were already compromised. Mathspace is an Australian company and BOD 26-04 does not bind it. But the directive’s premise is not jurisdictional. CISA’s stated rationale for compressing these clocks is that the interval between disclosure and exploitation is shrinking. This incident is that premise with dates attached: the interval here was four days, and it was four days for a flaw that was already being exploited before the advisory existed.
The reason self-hosted business intelligence is a particularly bad thing to be slow on deserves its own sentence. Metabase’s advisory spells out the blast radius: an attacker with administrator access “could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.” A reporting tool is, by construction, the one system holding live credentials to every database worth reporting on. It is not a peripheral app. It is a credential vault with a dashboard on the front, and it is very often owned by a data team rather than a security team, which is how it ends up outside the patch cadence that covers the actual application.
Note what the attacker took and what they did not. No passwords, no tokens, no SSO credentials, no academic records — Mathspace is clear on that, and it is a meaningful limit. What did leave is a clean, structured list of over a million names, email addresses, and roles, with each record labeled by user type and last-active date. That is not a credential dump; it is a targeting list, and the role field tells an attacker which of those addresses belongs to a staff member. Mathspace’s own guidance to users is built around exactly that risk, warning them to “Check unexpected messages independently. Be cautious even if a message uses your name or refers accurately to your school or this incident.”
The record problem underneath this one is smaller but not trivial. A vendor advisory that says “No known CVE” about a KEV-listed 10.0 is a broken link in the chain that most organizations rely on. The team that patched late here was reading a page that gave them no identifier to look up, no severity from a third party, and a version table that contradicts itself on two builds. None of that excuses 23 days. All of it makes 23 days easier to arrive at.
What to do
If you run self-hosted Metabase, confirm your build against the CVE record rather than the vendor table: NVD treats 0.63.0 through 0.63.4 as affected, and the vendor’s own page stops at 63.3 while shipping the fix in 63.5. Patched builds are 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5, with matching enterprise 1.x lines.
Patching is not the end of it. This was exploited in the wild from at least August 3, and the exploit path creates sessions and API keys. Enumerate API keys and active sessions in Metabase and revoke anything you cannot account for. Rotate the stored credentials for every database Metabase connects to, on the assumption that an administrator-level attacker read them. Review Metabase’s audit log and your database query logs for the window between the advisory and your patch.
Take the instance off the public internet. Metabase’s exposure here fell on customers with publicly reachable instances. A reporting tool has no business being one of them.
If you are a Mathspace user or a parent of one, expect phishing that knows your name, your school, and this incident. Mathspace’s advice is sound: verify unexpected messages through a channel you chose, never supply a password or a verification code in response to a message, and change any password you reused elsewhere.
Sourcing note
Checked: Mathspace’s disclosure post at blog.mathspace.co, published September 5, 2026 and updated September 8, read directly for the affected count, the field lists, the timeline, the regulator list, and all quoted language. NVD’s API record for CVE-2026-72898, for the description, the CVSS scores and vector, the affected ranges, and the CISA KEV fields quoted above. Metabase’s GitHub security advisory GHSA-vwf4-m7j8-wcjf, published August 6, 2026, for the affected and patched version tables, the severity, the “No known CVE” field, and the impact description. Metabase’s own postmortem blog post, for the August 3 customer report and the cloud-customer figure.
Could not reach: CISA’s KEV catalog pages directly, which return 403 to automated fetching. The KEV dates above are taken from NIST’s republication of CISA’s fields in the NVD record, which is the standing practice here.
Unresolved: whether the attacker who reached Mathspace is the same actor behind the earlier reported Metabase intrusions, which nobody has established and which we are not asserting. Whether the New Zealand reporting database was touched — Mathspace’s timeline names only the Australian one as downloaded, while the affected population covers both countries. Why Metabase’s advisory still shows no CVE and why its v63 affected range stops two builds short of the patched release; we have not found a vendor statement addressing either.