Bottom line: A zero-day vulnerability in Metabase rated CVSS 10.0, already being actively exploited, allows unauthenticated attackers to gain full administrator access to the platform via SQL injection.
Metabase is warning of a vulnerability with the maximum CVSS score of 10.0 in its business intelligence and data visualization software, which is already being actively exploited as a zero-day. No CVE ID has been assigned so far.
The vulnerability allows an unauthenticated, remote attacker to inject arbitrary SQL code into Metabase’s application database. According to the vendor, this SQL injection can be used to gain administrator-level access without requiring prior login. The flaw affects the core component of the software, which is used by organizations to analyze and visualize business data. No official CVE identifier has been assigned to the vulnerability so far.
For CISOs, the combination of maximum severity, lack of an authentication requirement, and already confirmed exploitation in the wild is particularly critical. Metabase instances are frequently operated with access to sensitive business data and connected databases, meaning a successful attack could compromise not only the BI platform itself but also provide insights into or direct access to downstream data sources. Since no user interaction and no valid credentials are required, the attack surface is significant, especially for publicly accessible Metabase servers.
Operators should immediately check whether their Metabase instances are reachable from the internet and, where possible, restrict access to internal networks or VPN connections. As the original report does not specify a concrete patched version, the current Metabase vendor advisory should be consulted in order to promptly apply available security updates or workarounds. Additionally, it is advisable to review existing logs for signs of unusual SQL activity or unexpected administrative access in the period before the vulnerability became known.
Source: thehackernews.com · Published August 8, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.