Metabase Zero-Day Vulnerability Enables Unauthenticated Admin Access

A critical zero-day vulnerability in Metabase (CVSS 10.0) allows unauthenticated attackers to inject SQL and gain admin access, enabling data theft and configuration changes. Affected versions are specified, with patches released and temporary workarounds advised.

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day.

The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain

Read original article