Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

A CVSS 10.0 zero-day in Metabase is being actively exploited to grant unauthenticated admin access. Self-hosted instances are at immediate risk of data theft, credential exposure, and unauthorized configuration changes. Metabase Cloud has been patched, but self-hosted deployments remain vulnerable.

CRITICALAdvisoryAug 08, 2026

Action required

Immediately inventory all Metabase instances (cloud and self-hosted) in your environment. Prioritize patching self-hosted deployments to the latest version. Monitor access logs for unauthenticated admin account creation or privilege escalation attempts.

Affected products

MetabaseMetabase Cloud

Linked articles

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Source links

https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html