importantSYS.SOURCE: The Hacker News• 2026-08-08T12:28:31+05:30

Metabase Zero-Day Vulnerability Enables Unauthenticated Admin Access

#vulnerability #security #data breach

A critical zero-day vulnerability in Metabase (CVSS 10.0) allows unauthenticated attackers to inject SQL and gain admin access, enabling data theft and configuration changes. Affected versions are specified, with patches released and temporary workarounds advised.

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day.

The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain

Read original article

*** END OF TRANSMISSION ***

> APPLE LAUNCHES DEVICE LEASING INITIATIVE FOR IPHONES AND ACCESSORIES > AMAZON'S NEW TEXAS DATA CENTER LINKED TO HIGH-EMISSION POWER PLANT > US CYBER COMMAND UNIT INVESTIGATES MULTIPLE SUICIDE DEATHS AMONG PERSONNEL > EUROPEAN SATELLITE SERVICE ENHANCES WILDFIRE TRACKING CAPABILITIES > DEEPMIND'S WEATHERNEXT AI MODEL ENHANCES CYCLONE FORECASTING ACCURACY > ATLASSIAN ROVO VULNERABILITY ALLOWS EXFILTRATION OF JIRA AND CONFLUENCE DATA VIA PROMPT INJECTION > CSS-BASED WEBMAIL VULNERABILITIES ENABLE PASSWORD AND TOKEN THEFT VIA UI MANIPULATION > DISCOVERY OF HARDWARE BACKDOOR IN VIA C3 X86 PROCESSORS > METABASE ZERO-DAY VULNERABILITY ENABLES UNAUTHENTICATED ADMIN ACCESS > N-ABLE RELEASES N-CENTRAL HOTFIX 2 TO ADDRESS EXPLOITED VULNERABILITY AND PERSISTENCE THREATS> APPLE LAUNCHES DEVICE LEASING INITIATIVE FOR IPHONES AND ACCESSORIES > AMAZON'S NEW TEXAS DATA CENTER LINKED TO HIGH-EMISSION POWER PLANT > US CYBER COMMAND UNIT INVESTIGATES MULTIPLE SUICIDE DEATHS AMONG PERSONNEL > EUROPEAN SATELLITE SERVICE ENHANCES WILDFIRE TRACKING CAPABILITIES > DEEPMIND'S WEATHERNEXT AI MODEL ENHANCES CYCLONE FORECASTING ACCURACY > ATLASSIAN ROVO VULNERABILITY ALLOWS EXFILTRATION OF JIRA AND CONFLUENCE DATA VIA PROMPT INJECTION > CSS-BASED WEBMAIL VULNERABILITIES ENABLE PASSWORD AND TOKEN THEFT VIA UI MANIPULATION > DISCOVERY OF HARDWARE BACKDOOR IN VIA C3 X86 PROCESSORS > METABASE ZERO-DAY VULNERABILITY ENABLES UNAUTHENTICATED ADMIN ACCESS > N-ABLE RELEASES N-CENTRAL HOTFIX 2 TO ADDRESS EXPLOITED VULNERABILITY AND PERSISTENCE THREATS