Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Summary

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.