Metabase warns of exploited zero-day allowing unauthenticated SQL injection and admin access

70/100

Metabase reports that a maximum-severity flaw (CVSS 10.0, no CVE assigned) in its business intelligence software was exploited in the wild as a zero-day, letting unauthenticated remote attackers inject SQL into the application database and gain admin access. Metabase operators, especially those with internet-exposed instances, should update to the fixed release and check for unauthorised admin activity.