Will Metabase SQLi zero-day be added to CISA KEV by September 2026?

Metabase disclosed a critical SQL injection zero-day (CVE unspecified) being actively exploited in the wild for customer data theft, with confirmed victims including Framework and Tally (Bleeping Computer). This is an active, unpatched exploitation scenario with material business impact.

Resolution Criteria

Official CISA Known Exploited Vulnerabilities (KEV) Catalog listing naming the Metabase SQLi flaw and confirming inclusion before Sept 30, 2026. Alternatively, Metabase official security advisory + Bleeping Computer or CISA confirmation of active wild exploitation and vendor patch release.