Tech Times on MSN

Metabase SQL injection breached five companies, exposed all connected database credentials

Metabase SQL injection vulnerability gave unauthenticated attackers full admin access and downstream database credentials, breaching five companies. CISA added CVSS 10.0 CVE-2026-72898 and Cisco ASA ...
The Hacker News

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase says a CVSS 10.0 zero-day SQL injection was exploited in the wild; the flaw can grant admin access and expose ...