Organization

Kilo Code

0 mentions in 7 days · 1 in 30 days · 2 total · first seen Aug 12, 2026 · last 7d ago

Timeline2 articles

Mathspace breach exposes data on over a million students and parents

Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Attackers accessed Mathspace's self-hosted Metabase reporting system without legitimate login, with unauthorized access dating back to 10 August 2026 and data downloaded on 27 August. Exposed data includes names, usernames, email addresses, country, and account metadata; no passwords, academic records, SSO tokens, or API credentials were taken. Framework, Tally, and Kilo Code disclosed similar breaches via the same Metabase SQL injection flaw in August 2026.

Help Net SecuritySep 8, 08:45 UTC · 7d agoData breach in the wild

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.

Metabase disclosed a maximum-severity SQL injection affecting versions x.58 through x.63 that lets unauthenticated attackers inject SQL via the /api/session/reset_password endpoint and gain administrator access to Metabase instances. Metabase Cloud was attacked, patches were released, and CISA added CVE-2026-72898 to the KEV catalog with a federal remediation deadline of August 14, 2026. Downstream victims include Framework (customer names, IPs, addresses, phone numbers, and emails accessed), n8n (136 customer records, five with bcrypt-hashed passwords), and Kilo Code (Slack access tokens). Wiz estimates roughly 13% of cloud environments run self-hosted Metabase, with about 2,500 instances internet-accessible.

The Hacker NewsAug 12, 13:47 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-72898 CVE-2023-38646

Related CVEsby mentions

CVE-2026-7289810.094%
Unauthenticated SQL Injection in Metabase Grants Admin Access
CVE-2026-72898 is a critical SQL injection flaw (CWE-89, CVSS 4.0 score of 10) in Metabase, a widely used open-source business intelligence platform. A remote, unauthenticated attacker can send crafted input to the '/reset_password' database endpoint to inject arbitrary SQL into the underlying database. Successful exploitation grants the attacker administrator access to the connected Metabase instance, with confidentiality, integrity, and availability impacts rated high in the CVSS 4.0 vector. Any organization running an affected Metabase instance, particularly one exposed to the internet, is at risk. The flaw is a zero-day being exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11, and carries a 94.2% EPSS probability of exploitation within 30 days (100th percentile).
· Metabase KEV PoC large
CVE-2023-386469.899%
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privil
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
· metabase metabase—

Appears with

vendor Metabase 2 organization Framework 2 product Metabase 2 organization Tally 1 organization Wiz 1 product Metabase Cloud 1 vendor CISA 1 vendor Wiz 1 victim Framework 1 victim Kilo Code 1 victim Mathspace 1 organization CISA 1 victim n8n 1 organization Engadget 1 organization n8n 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.