Metabase Rushes Out Patch After Hackers Exploit Flaw as Zero-Day

Metabase, a widely used business intelligence and analytics platform, has released a patch for a critical vulnerability that was actively exploited by attackers before a fix existed. The flaw allowed unauthenticated remote attackers to gain administrative access to Metabase instances, meaning they could potentially view, alter, or control sensitive business data without needing valid login credentials.

Because the vulnerability was exploited as a zero-day, some organisations may have been compromised before the patch became available. This type of flaw is especially dangerous because it removes the need for stolen passwords or phishing — attackers can simply target exposed systems directly over the internet.

Any Australian small business using Metabase for dashboards, reporting, or data analytics should treat this as an urgent update. Delaying patches on internet-facing tools like this significantly increases the risk of data theft or unauthorised access to business systems.