Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius

A zero-day SQL injection in Metabase Cloud (affecting v1.58+) was exploited in the wild, giving attackers administrator access to instances, the ability to change configuration, steal stored database credentials, read and export connected data, and impact downstream organizations. Metabase patched and auto-upgraded Cloud instances but warned self-hosted customers to upgrade or block the /api/session/reset_password endpoint; several companies (n8n, Kilo) disclosed customer data exposure as a result.