🔴 Critical | Source: The Hacker News
A critical zero-day vulnerability in Metabase, a widely used business intelligence and data visualisation tool, is being actively exploited in the wild. The flaw carries a maximum CVSS score of 10.0 and allows unauthenticated attackers to inject arbitrary SQL into the Metabase database, potentially granting full administrative access. Because no CVE identifier has been assigned yet and exploitation is already occurring, organisations running Metabase face immediate risk.
Security Architect’s Take: Immediately audit your environment for any internet-exposed Metabase instances and apply the vendor’s patch or mitigation guidance without delay. If patching is not immediately possible, restrict network access to Metabase to trusted IP ranges only and review database activity logs for signs of unauthorised SQL execution.
Original advisory: Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication