Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

AI Summary

Metabase has disclosed a CVSS 10.0 zero-day vulnerability with no CVE assigned yet that allows unauthenticated remote attackers to inject arbitrary SQL into the application database, granting full admin access without credentials. Active exploitation in the wild has been confirmed, making immediate patching critical for any organization running Metabase for business intelligence or data visualization.

Read full article → https://thehackernews.com/2026/08/metabase-zero-da…

Relevance score: 87.0/100

# More from August 09

1
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens The Hacker News
3
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts The Hacker News
4
N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist The Hacker News
5
New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables The Hacker News
6
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails The Hacker News
7
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer The Hacker News
8
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign The Hacker News
9
North Carolina Ports confirms cyberattack disrupting operations BleepingComputer
10
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access The Hacker News