Metabase, one of the most widely deployed open-source business intelligence tools, disclosed on August 8 that an unauthenticated attacker can inject arbitrary SQL through its application layer and walk away with full administrator control of the instance, no login, no session, no exploit chain beyond a single crafted request. The flaw carries the maximum CVSS score of 10.0 and was already being exploited before Metabase found and fixed it, which is the detail that should worry anyone running a self-hosted deployment: this was not a theoretical finding from a security researcher, it was live in the wild first. What makes this particularly dangerous is what Metabase actually is in most stacks, a dashboard layer that holds live credentials to a company's production databases so it can query them on demand. An attacker who becomes an admin does not just deface a dashboard; they can read or export any data reachable through Metabase's saved database connections, rotate or exfiltrate those stored credentials, and quietly rewrite application configuration to keep access after the fact. Metabase has published the specific version ranges affected across six release lines and pushed fixes to all of them, along with concrete indicators of compromise operators can grep out of their access logs. For teams that treat internal analytics tools as low-risk because they are 'just for looking at data,' this is a clear reminder that any tool wired directly into a production database is effectively as sensitive as the database itself, and patching cadence for BI and dashboarding software deserves the same urgency normally reserved for the database or the auth system in front of it.