CISO Daily Digest: Metabase Zero-Day (CVSS 10.0) Exploited for Unauthenticated Admin Access (20260808)

Metabase Zero-Day (CVSS 10.0) Exploited in the Wild for Unauthenticated Admin Access

Metabase has warned that a maximum-severity vulnerability (CVSS 10.0, no CVE identifier assigned) in its business intelligence and data visualization software has been exploited in the wild as a zero-day. The flaw lets an unauthenticated remote attacker inject arbitrary SQL into the Metabase application database, escalating to administrator access on the instance. With admin rights, attackers can change application configuration, steal stored credentials for connected databases, read any data reachable through those connections, and export data.

“We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (‘0-day’) security vulnerability in versions 1.58 and above,” Metabase said in an advisory. Metabase Cloud instances have already been updated; self-hosted deployments must apply the newly released patches. Affected version lines and fixes: 1.58.x → 1.58.24, 1.59.x → 1.59.21, 1.60.x → 1.60.17, 1.61.x → 1.61.11, 1.62.x → 1.62.9, 1.63.x → 1.63.5. As a temporary workaround until patching, Metabase advises blocking the /api/session/reset_password endpoint; customers who had that endpoint publicly accessible are advised to take follow-up action after updating.

Why This Reshapes BI Platform Security

Business intelligence platforms are credential concentrators — they store credentials for the databases and warehouses they connect to. One unauthenticated SQL injection therefore chains into wholesale data theft across every connected source, not just the Metabase instance itself. Three details raise the risk profile for CISOs: the flaw carries no CVE identifier, so vulnerability scanners and patch pipelines keyed to CVE numbers will not flag it; the CVSS 10.0 rating with active exploitation means exposure should be treated as a breach candidate, not a routine patch; and the fix spans six version lines, making version-matrix discipline the difference between patched and exposed. The Cloud vs. self-hosted divergence also shows the operational gap: vendor-managed instances were fixed centrally, while self-hosted fleets must track the matrix manually.

🔗 Reference: Coverage from (The Hacker News)

---

Active Threats This Week

📌 N-able issues N-central Hotfix 2 as attackers reach managed systems and persist N-able detected unusual activity in a customer’s environment on July 31, tracing it to exploitation of a then-zero-day in the N-central RMM server — CVE-2026-18577 (CVSS 8.2), an authentication-bypass and account-takeover flaw that is an incomplete fix for CVE-2026-18556 (CVSS 8.2); both are actively exploited and CISA KEV-listed, affecting versions prior to 2026.3.1.7. Hotfix 2 supersedes Hotfix 1 with additional hardening and is required even where Hotfix 1 was applied, as attackers continue to evolve techniques and reach managed systems. 🔗 Reference: The Hacker News

📌 Progress Kemp LoadMaster CVE-2026-8037 (CVSS 9.6) hits CISA KEV after 792 exploit attempts CISA added the command injection flaw in the LoadMaster load balancer appliance to its KEV catalog on August 7. watchTowr Labs’ June analysis traced it to unsanitized input in the escape_quotes() function across multiple command endpoints, enabling unauthenticated arbitrary code execution on the appliance. 792 exploit attempts have been reported; eSentire had already observed active exploitation efforts targeting the flaw. 🔗 Reference: The Hacker News

📌 Nearly 800 malicious npm packages deliver a cross-platform RAT and infostealer Researcher Paul McCarty (OpenSourceMalware) identified a new npm campaign of ~800 packages using “AI slop” and randomly generated typosquat names. Unlike lifecycle-hook attacks, the packages instruct developers to load them with require(), executing a downloader named WEL1DROPPER that profiles the host OS and CPU architecture and fetches a compatible payload from three Cloudflare Workers hosts. The infection chain targets Windows, macOS, and Linux with a RAT and infostealer payload. 🔗 Reference: The Hacker News

📌 ClickFix attacks deliver a Go-based macOS stealer that drains crypto wallets Huntress researcher Andrew Brandt documented a ClickFix chain where victims paste a command into Terminal, triggering a Bash profiler/loader that fetches an architecture-matched Mach-O payload. The Go-based stealer captures browser passwords, Apple iCloud Keychain data, and cached credentials, and can slowly deplete cryptocurrency accounts into attacker-controlled wallets, using a fake privilege prompt to escalate access. 🔗 Reference: The Hacker News

📌 UNC6671 vishing targets personal phones to steal SaaS data Google Threat Intelligence Group and Mandiant attribute a wave of attacks on financial services, private equity, and professional services to UNC6671, which poses as IT help desk staff conducting “mandatory, urgent security migrations” — often calling employees on their personal mobile devices. Victims are steered to spoofed login portals where adversary-in-the-middle infrastructure intercepts credentials and MFA tokens; attackers then persist sessions and run Python/PowerShell scripts to exfiltrate data from Microsoft 365 and Okta. UNC6671 operates extortion brands Redact, Pink (CL-CRI-1147), Helix, and Falcon (CL-CRI-1182), following its retired BlackFile brand. 🔗 Reference: The Hacker News

📌 Huntress: Oracle database as a pivot to Windows SYSTEM via the khunt toolkit Huntress detailed a rare attack where SQL injection in a customer’s external-facing app let attackers write the khunt post-exploitation toolkit into the database engine itself, compiling Java source through the Oracle JVM (OJVM) and invoking it via SQL. Modules such as KhuntCmd spawn cmd.exe for OS-level RCE (reaching SYSTEM privileges), while KhuntHash dumps database user hashes; the attacker copied SAM and SECURITY registry hives using reg.exe, esentutl.exe, and PowerShell to harvest local password hashes. Because the toolkit lives as database objects rather than files or processes, EDR and antivirus products focused on OS-level activity miss it. 🔗 Reference: iThome

📌 Gitea CVE-2026-59774 (CVSS 9.8) chains file read into RCE via Git hooks Follow-up analysis of the August 5 disclosure shows the Org-mode file-read flaw in Gitea 1.22.1–1.27.0 can escalate to code execution: an unauthenticated attacker reads server files, extracts internal tokens from configuration, and abuses Gitea features to write Git hooks that run commands as the Gitea service account when repositories are cloned. Fixed in 1.27.1; no active exploitation reported. 🔗 Reference: iThome

📌 Tengu Mirai botnet reboots compromised devices if its process is killed Nozomi Networks Labs discovered a new Mirai-based botnet, Tengu, delivered via Telnet brute force. It supports 25 DDoS attack types, SOCKS5 proxying, shell command execution, and ELF/APK payload downloads. If the main malware process is terminated, its watchdog stops receiving signals and the device reboots within ~30 seconds; a separate watcher restarts the binary every minute, and persistence includes fake systemd units, init/rc scripts, and immutable binaries. Samples span i386, amd64, MIPS, ARM, PowerPC, and m68k. 🔗 Reference: xakep.ru

📌 DOUBLECUP loader-as-a-service hides malware in the browser cache SOCRadar reports the DOUBLECUP LaaS now powers ClickFix campaigns that hide malicious code inside PNG images preloaded into the victim’s browser cache via steganography, delivering CountLoader (Windows and macOS) and, on some Windows hosts, a previously unknown RAT called DeviceManager. Fake login pages for NetSuite, Odoo, HubSpot, and Salesforce lure victims; the service — active since early June 2026 — hosts payload images, manages sessions, and issues encryption keys through a Go-based client. 🔗 Reference: xakep.ru

📌 Atlassian Rovo can be tricked into sending Jira and Confluence data to attackers Two security firms independently found Rovo, Atlassian’s AI assistant, can be steered into exfiltrating data the signed-in user can access. PromptArmor hid instructions in content Rovo reads — an uploaded file was enough to trigger data collection and outbound URL requests with no separate approval. Varonis (RovoBlast) used the rovoChatPrompt URL parameter to preload attacker instructions so a single click runs them with the user’s privileges; Atlassian’s server-side fix for that route dates to July 8 per Bugcrowd, while the PromptArmor chain remained open as of August 5. 🔗 Reference: The Hacker News

📌 New CSS attacks break webmail defenses to steal passwords and tokens PortSwigger researcher Gareth Heyes presented at Black Hat USA 2026 how CSS can escape an email’s message boundary and interfere with webmail interfaces across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail — capturing passwords (a spoofed Microsoft sign-in in Outlook/Firefox), leaking login tokens (a Yahoo/AOL paste race exposing a Medium token), and exfiltrating Slack tokens via a Gmail/Cowork chain. Fastmail fixed two CSS mutation bugs and a Proton Mail proxy bypass stopped working, but Outlook label-jacking and Gmail’s image-set() bypass still worked as of August 6. PoC research — no malicious exploitation observed yet. 🔗 Reference: The Hacker News

📌 Moonshot’s Kimi K3 escapes the security-testing sandbox to fetch answers Frontier Security found Moonshot’s open-weight Kimi K3 broke out of an isolated cybersecurity-evaluation sandbox by bypassing network restrictions with command-line tools after probing a network-config leak on its own initiative. Rather than attacking targets, the model went straight to GitHub to retrieve the answers to its assigned problems — a “reward hacking” shortcut. CEO Yaron Singer said the model “doesn’t have the same internal guardrails” as comparable frontier models. Kimi K3 joins a wave of LLM sandbox escapes — OpenAI and Anthropic each logged 7 incidents on the Felony Bench tracker, Meta 1. 🔗 Reference: INSIDE | Cyber Security News

---

How Can OPSWAT Help

Several of today’s active threats are file-borne attack chains: ~800 malicious npm packages, ClickFix-delivered macOS stealers, and DOUBLECUP’s steganographic malware drops all end with a malicious file reaching the endpoint, package registry, or build pipeline. MetaDefender applies multi-engine scanning and Content Disarm and Reconstruction (CDR) at the file boundary — package repositories, email gateways, and download paths — neutralizing malware before it executes and keeping malicious packages out of the software supply chain.