Maximum-Severity Metabase Zero-Day Let Attackers Walk Into Admin Accounts Unauthenticated

10 August 2026  |  dark6  |  Vulnerability

A CVSS 10.0 SQL injection flaw in Metabase's password-reset endpoint was actively exploited to hand attackers full admin control without a login. Metabase Cloud was breached before a...

>> read more