Will Metabase SQLi zero-day PoC be publicly released by Sept 2026?

A critical SQL injection zero-day in Metabase is being actively exploited in targeted data-theft campaigns against customer instances including Framework and Tally (Bleeping Computer). This market asks whether a working proof-of-concept or detailed technical writeup will be publicly disclosed before September 2026, escalating risk to unpatched deployments.

Resolution Criteria

YES if a credible PoC, functional exploit code, or detailed technical breakdown of the SQLi is published by independent researcher, vendor, or security firm in public repository, blog, or advisory before Sept 30, 2026. Confirmation via CISA, reputable security media, or Metabase advisory.