Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase disclosed a maximum-severity SQL injection flaw, now tracked as CVE-2026-72898 with a CVSS score of 10.0, that lets an unauthenticated remote attacker inject arbitrary SQL through the '/reset_password' endpoint and gain administrator access to the...