Engadget

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenAug 12, 2026
Last mentionedAug 12, 2026

Timeline

1 articles · newest first

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.

The Hacker NewsAug 12, 13:47 UTC · Aug 12, 2026Exploit / PoCExploitedCVE-2026-72898 CVE-2023-386462 · 1 read

Related CVEs

by mentions

CVE-2026-7289899%10.0
Unauthenticated SQL Injection in Metabase Grants Admin Access
published Aug 10, 2026MetabaseKEVPoC ×3
CVE-2023-3864699%9.8
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's…
published Jul 21, 2023metabase metabase

Appears with

Frameworkvictim · 1
Wizvendor · 1
Kilo Codeorganization · 1
CISAvendor · 1
n8nvictim · 1
Wizorganization · 1
Kilo Codevictim · 1
Frameworkorganization · 1
Metabase Cloudproduct · 1
CISAorganization · 1
Metabaseproduct · 1
n8norganization · 1
Metabasevendor · 1

Entities are extracted by the model from each article. First seen Aug 12, 2026, last mentioned Aug 12, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.