Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain

Metabase disclosed that an unknown zero-day in versions 1.58 and above was exploited in the wild, allowing an unauthenticated attacker to inject arbitrary SQL into the Metabase application database and potentially obtain administrator access[1]. Metabase says compromise could expose stored database credentials, connected data, and exported data, and it published log patterns that may indicate intrusion[1]. RealGround assessment: this is primarily a data leakage and exposure event with high operational impact, so the most relevant services are readiness and advisory support to assess blast radius, validate exposure, and harden response controls.