Hosted on MSN

Metabase SQL injection breached five companies, exposed all connected database credentials

A single unauthenticated HTTP request to Metabase's password-reset endpoint was all it took for an attacker to gain full administrator access to an analytics platform trusted by tens of thousands of ...
socprime.com

Warning on Recent Unauthorized Access to Japanese Organizations

Unauthorized access incidents at Japanese organizations leaked personal data via known flaws, Metabase SQL injection, API ...

[Security] JPCERT/CC Issues Urgent Alert to Domestic Organizations: The Threat of 'API Abuse' and 'Metabase Vulnerabilities' Behind Successive Personal Information L…

On October 8, 2026, the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) published an alert ...
Dark Reading

Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius

A zero-day SQL-injection vulnerability in Metabase Cloud is under exploitation in the wild, and it could spell trouble for many downstream organizations. Metabase, which provides AI-driven business ...
Help Net Security

Metabase zero-day exploited to access Framework customer data

Framework, the San Francisco-based company that designs repairable and upgradeable laptops, has suffered a data breach after attackers managed to exploit a zero-day vulnerability in the Metabase ...