Metabase patches critical unauthenticated SQL injection exploited in zero‑day data theft
Metabase disclosed a critical unauthenticated SQL injection (GHSA‑vwf4‑m7j8‑wcjf) that allowed attackers to become admin and exfiltrate data from cloud and self‑hosted instances. The flaw was actively exploited in attacks against customers such as Framework and Tally. Metabase urges immediate upgrade to patched versions (≥0.58.24, 0.59.21, etc.).