METABASE SQL ZERO-DAY ATTACKS COULD HAVE WIDE BLAST RADIUS

Summary from the TLDR InfoSec newsletter

A zero-day SQL injection flaw in Metabase Cloud (CVSS 10, no CVE yet) let an attacker inject SQL into the app database and get admin access, steal database credentials, and export data. Metabase patched cloud instances automatically. Self-hosted users with the /api/session/reset_password endpoint exposed on port 3000 remain vulnerable. n8n confirmed 136 leaked customer records. Kilo Code confirmed exposed Slack tokens and customer data. Metabase told self-hosted users to patch now or block that endpoint, rotate credentials, and revoke sessions.