{"id":2286,"date":"2026-08-08T08:35:19","date_gmt":"2026-08-08T08:35:19","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2286"},"modified":"2026-08-08T08:35:19","modified_gmt":"2026-08-08T08:35:19","slug":"metabase-zero-day-exploited-in-wild-allows-admin-access-without-authentication","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2286","title":{"rendered":"Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 08, 2026<\/span><\/span>Zero-Day \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Metabase has warned<\/a> that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day.<\/p>\n

The vulnerability<\/a> (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain administrator access to the instance.<\/p>\n

Armed with the elevated access, the attacker can change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.<\/p>\n

\u00abWe recently identified that Metabase Cloud was attacked by someone utilizing an unknown (‘0-day’) security vulnerability in versions 1.58 and above,\u00bb Metabase said in an advisory.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Metabase Cloud instances have already been updated to the latest version. Users running self-hosted versions are advised to apply security patches released by Metabase with immediate effect. The following versions are affected –<\/p>\n

<\/p>\n