Metabase Zero-Day Hits CVSS 10.0: Unauthenticated SQL Injection Gives Full Admin

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase says a CVSS 10.0 zero-day SQL injection was exploited in the wild; the flaw can grant admin access and expose connected database data.