Metabase released an emergency security advisory for a maximum-severity zero-day vulnerability actively exploited in the wild. The flaw carries a CVSS score of 10.0, the highest possible rating, and permits unauthenticated remote attackers to inject arbitrary SQL commands into the Metabase application database.

The vulnerability enables attackers to bypass authentication entirely and gain administrative access to affected instances. No CVE identifier has been assigned yet. Threat actors exploit this by crafting malicious SQL injection payloads that execute against the underlying database, allowing full system compromise without valid credentials.

Metabase is a widely deployed open-source business intelligence platform used by organizations to query, visualize, and analyze data from multiple sources. The software powers dashboards and analytics tools for companies across finance, healthcare, retail, and technology sectors. A zero-day affecting it creates immediate risk for any organization running unpatched instances.

The zero-day exploitation appears active and widespread. Organizations using Metabase should treat this with urgency given the attack surface and the complete loss of authentication controls. An attacker gaining admin access can exfiltrate sensitive data, modify reports, inject malicious queries, or pivot to backend systems and databases connected to Metabase.

Metabase has released patches to address the vulnerability. Organizations must apply updates immediately to all internet-facing and internal Metabase deployments. Teams should review access logs for evidence of unauthorized SQL injection attempts or suspicious administrative actions.

Until patches deploy, network segmentation and access controls become critical. Restricting Metabase access to trusted internal networks only, implementing Web Application Firewalls with SQL injection detection, and monitoring database query logs for anomalies can reduce exposure.

The lack of a CVE designation should not delay patching efforts. The 10.0 CVSS rating and active exploitation confirm the threat