Metabase SQL injection flaw CVE-2026-72898 grants admin access without login

·1 views

A critical unauthenticated SQL injection vulnerability, CVE-2026-72898, was discovered in Metabase, a widely used business intelligence platform that stores database credentials for connected data warehouses. The flaw exists in the password-reset endpoint's user-id parameter, which passes unsanitised input into a query, allowing attackers to forge an administrator session via a crafted SQL payload without needing any credentials. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 11 August 2026, setting a federal remediation deadline of just three days. The threat group ShinyHunters has been linked to active exploitation, with affected organisations including Mathspace, which reported over one million students and staff impacted across Australia and New Zealand. Patched versions are available across six Metabase release lines from 0.58 through 0.63, and security experts stress that patching must be followed by credential rotation to fully contain any breach.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to verify drand randomness beacons in your app using 30 lines of code

Developers building agents that rely on random numbers often use HTTP relay APIs, but these relays cannot be independently trusted to deliver unaltered data. The drand project, operated by the League of Entropy, publishes a public randomness beacon every three seconds using BLS signatures, allowing anyone to verify results offline with a pinned public key. By fetching the same round directly from drand's own endpoint and comparing it against the relay's response, developers can confirm the beacon has not been tampered with or replayed. A small code example using the drand-client npm package demonstrates how to perform this cross-verification in under 30 lines. The approach reduces reliance on relay trust and enables reproducible, auditable random sampling for use cases like reviewer selection, tie-breaking, or raffles.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer releases npm tool to auto-generate aligned comment dividers in code

A developer frustrated with manually aligning comment-based section dividers in code files has published an open-source npm package called code-divider. The tool replaces lightweight inline markers like @reg and @sec with fully formatted, centered header blocks that consistently end at column 79. Users can run it from the command line, point it at a specific file or directory, or configure it to trigger automatically on save via editor extensions. The package supports over a dozen languages including TypeScript, Python, Go, Rust, and SQL, using each language's native comment syntax. Unlike editor snippets, the tool dynamically sizes the filler characters around each label so all headers remain uniform regardless of label length.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

12-Week Roadmap Outlines How Developer Tools Should Use Full Repo Context

A newly published 12-week Developer Tools and Code Intelligence roadmap lays out a structured approach to building smarter, safer developer tooling. The plan begins with code review, static and dynamic analysis, and testing infrastructure as distinct but complementary evidence sources. A middle phase focuses on repository context, including codebase graphs, blast-radius analysis, and IDE or CLI integration to reflect real workflows. The final phase introduces coding agents, supply-chain health checks, and automated remediation, with an emphasis on transparency around why changes are suggested and how outcomes will be verified. The roadmap argues that effective developer tools must be repository-aware rather than generic, with measurable value and clearly visible limitations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Multi-Agent AI Swarms Cut a 45-Minute Task to Minutes Using Hive Logic

Software engineer Derek Wang argues that running AI agents serially creates a hard ceiling on efficiency, with elapsed time growing linearly and coordination costs mounting quickly. Drawing on Kevin Kelly's observations about decentralised bee colonies, Wang proposes splitting large tasks into independent parallel subtasks rather than relying on a single sequential agent. Instead of a central scheduler, his team adopted a work-stealing model where idle agents pull jobs from busier agents' queues, eliminating the bottleneck of fixed task assignment. A recurring failure mode — agents hanging unattended and wasting 30-plus minutes before human intervention — was resolved by adding a watchdog that automatically detects stalled agents, redistributes their work, and recovers within five minutes. Wang frames the key insight as structural: parallel task design provides automatic fault recovery, not just speed gains.

0 comments Read more at DEV Community