TL;DR
what: Metabase disclosed that an unauthenticated SQL injection flaw in its BI platform was exploited in the wild as a zero-day, letting remote attackers write to the application database and grant themselves administrator access.
Metabase is telling self-hosted customers to patch now. An unauthenticated attacker can inject arbitrary SQL into the Metabase application database and promote themselves to administrator on the instance. CVSS 10.0. No CVE identifier was assigned. The vendor found the bug because someone used it against Metabase Cloud first, which makes this a confirmed in-the-wild zero-day rather than a theoretical maximum-severity rating.
The blast radius is not the BI tool. It is everything the BI tool connects to. With admin on a Metabase instance, an attacker changes application configuration, extracts the stored credentials for every connected database, reads any data reachable through those connections, and exports it. Metabase sits deliberately in the middle of an organization's data warehouses, production replicas, and analytics stores, holding standing credentials to all of them. Compromising it is closer to compromising a credential vault than compromising a dashboard.
