Metabase Zero-Day Vulnerability Actively Exploited in the Wild

Active exploitation has been confirmed for a critical SQL injection vulnerability in Metabase, the popular open-source business intelligence platform, allowing remote attackers to execute arbitrary queries against the underlying database without prior authentication.

The flaw resides in the public initial-setup endpoint (`/api/setup`), which in misconfigured installations remains accessible even after production deployment. An attacker can inject malicious parameters into that endpoint to read, and in some cases modify, data in the connected database.

Metabase is frequently used to expose analytics dashboards connected directly to production databases, which amplifies the impact: exploitation compromises not just the application, but potentially the entire business database behind it.

Operators should apply the emergency patch released by the Metabase team and, as an immediate mitigation, block public access to the `/api/setup` endpoint via firewall or reverse-proxy rules.