Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase warned of a maximum-severity zero-day vulnerability (CVSS 10.0) in its business intelligence software being exploited in the wild. The flaw allows unauthenticated remote attackers to inject arbitrary SQL into the application database, enabling admin access. No CVE identifier has been assigned yet. Users are urged to apply patches immediately.