DodoPayments review: Security After Metabase SQL Injection Incident
In short
Dodo Payments disclosed unauthorized access to its self-hosted Metabase analytics system in August 2026. The incident involved CVE-2026-72898 but left payment processing unaffected.
DodoPayments review covers the company's handling of a security incident that began around August 15, 2026. Attackers exploited a known Metabase vulnerability to reach an internal analytics instance. No payment processing systems or cardholder data were involved according to official statements.
The breach highlights risks tied to self-hosted business intelligence tools. Dodo Payments, a Bengaluru-based merchant-of-record platform, contained the access within hours and disclosed details on August 17. Third-party sources reference a dataset of 534,481 rows, though the company has not confirmed exact figures.
DodoPayments breach timeline and technical details
The vulnerability CVE-2026-72898, a critical unauthenticated SQL injection in Metabase, was publicly disclosed around August 6, 2026. CISA added it to the Known Exploited Vulnerabilities catalog with a patch deadline of August 14. Dodo Payments detected activity on August 16 and isolated the affected system the same day.
Attackers gained access through the POST /api/session/reset_password endpoint, bypassing authentication and obtaining credentials for connected data warehouses. The Metabase instance linked only to analytics databases used for internal reporting. Production payment environments remained separate throughout the event.
Dodo Payments stated that it revoked all active sessions, tokens, and keys after containment. It also patched the Metabase deployment and removed direct internet exposure from analytics infrastructure. Similar exploits affected other organizations including Framework, Tally, n8n, and Scalingo during the same period.
Scope of data exposure and verification status
Company statements confirm that no merchant funds, API keys, passwords, or card data were accessed. PCI DSS Level 1 certification remained in place. Official updates emphasize that the incident stayed limited to the analytics layer.
Third-party breach databases index approximately 534,481 rows containing emails, with smaller subsets of names, dates of birth, phone numbers, and addresses. Ransomware listings attributed to the direwolf group claim larger volumes from ClickHouse warehouses, yet these claims stay unverified by Dodo Payments or independent audits.
The platform processes subscriptions and payouts for SaaS products. Its SOC 2 and ISO 27001 programs were already in progress at the time of disclosure. Co-founders Ayush Agarwal and Rishabh Goel publicly confirmed rapid containment and direct notification plans for any affected merchants.
Remediation steps and ongoing user guidance
Dodo Payments has implemented additional controls including SSO enforcement, IP allow-listing, web application firewall rules, and formal vulnerability monitoring for third-party tools. Database connection architecture received a full review. Independent assessors were engaged for further evaluation.
Users should monitor the official incident page for updates and follow standard account hygiene practices such as credential rotation. The company advised other self-hosted Metabase operators to apply patches immediately after the vulnerability became known. No service disruptions or unauthorized fund movements occurred during the incident.
As of October 25, 2026, no additional public disclosures have appeared beyond the initial August statements. Merchants evaluating the platform can review Dodo Payments' published incident timeline and remediation commitments directly on its site.
Frequently asked questions
What exactly happened in the DodoPayments incident?
Attackers used a SQL injection flaw in a self-hosted Metabase instance to reach internal analytics databases around August 15, 2026. The company detected and contained access the next day. Payment systems stayed isolated from the affected environment.
Was customer payment data exposed during the DodoPayments breach?
Official statements confirm that cardholder data, API keys, passwords, and merchant funds remained untouched. The analytics system connected only to reporting warehouses, not to processing infrastructure.
How many records were involved according to available reports?
Third-party indexes list 534,481 rows, primarily emails. Larger unverified claims from ransomware sites reference additional analytics tables, but Dodo Payments has not confirmed these figures.
What actions did Dodo Payments take after the incident?
The company patched Metabase, revoked sessions and keys, removed internet exposure from analytics tools, and began formal SOC 2 and ISO processes. It committed to notifying affected merchants directly.
Should businesses continue using DodoPayments after the breach?
Payment processing remained unaffected and remediation measures addressed the analytics exposure. Organizations should review the company's incident updates and apply their own security practices when evaluating any processor.
TrustScope
Comments 1