Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data...
Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data Theft
1. Basic Information
Article Title: Metabase SQLi zero-day exploited in customer data-theft attacks
Publisher: BleepingComputer
Publication Date: August 7, 2026
Metabase SQLi zero-day exploited in customer data-theft attacks
Metabase Patches Vulnerability Exploited as Zero-Day
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius
Jetzt patchen! Admin-Attacken auf Metabase beobachtet
Metabase zero-day: Data leak at laptop manufacturer Framework
Hackers run khunt post-exploitation toolkit from Oracle database
Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Durch Metabase-0day: Datenleck bei Laptophersteller Framework
New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
TL;DR what: Metabase disclosed that an unauthenticated SQL injection flaw in its BI...
A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft…
A critical-severity SQL injection vulnerability in Metabase has been exploited as a zero-day to gain administrative privileges.
Metabase says a CVSS 10.0 zero-day SQL injection was exploited in the wild; the flaw can grant admin access and expose connected…
The max-severity vuln, which still has no CVE, allows malicious, remote administrator access to the business-analytics platform…
Angreifer nutzen zurzeit eine kritische Sicherheitslücke in der Business-Intelligence-Plattform Metabase aus. Admins müssen jetzt…
