Actively exploited vulnerabilities affecting Metabase products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-72898https://wildfortech.com/security#CVE-2026-72898This SQL injection flaw in Metabase requires no authentication, meaning any internet-accessible Metabase instance can be compromised without credentials. An attacker who exploits it gains administrator-level control, enabling them to alter application settings, harvest credentials for all connected databases, and exfiltrate any data those databases can reach. The breadth of potential data exposure — spanning the Metabase application itself and every downstream data source it connects to — makes this a high-priority risk for any organization running Metabase.Tue, 11 Aug 2026 00:00:00 GMTMetabaseMetabase