erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: August 6, 2026

2 editorial briefs and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection. Anyone self-hosting Metabase OSS or Enterprise version 58 or later below 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5 (1.x for Enterprise).
  • Check exposure: macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass. Owners of Macs with Screen Sharing or Remote Management enabled, especially hosted Mac mini or Mac Studio servers, CI build Macs and remotely administered machines with TCP 5900 reachable.
  • Go: 1 critical advisory (github.com/traefik/traefik/v2, github.com/traefik/traefik/v3, github.com/traefik/traefik). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-72898

Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection

Self-hosted Metabase 58 through 63 below the fixed point releases can be taken over without a login and was attacked as a zero-day; upgrade now, and if the reset endpoint was reachable, assume your connected database credentials are burned.

Must act: Anyone self-hosting Metabase OSS or Enterprise version 58 or later below 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5 (1.x for Enterprise).

Can relax: Metabase Cloud customers (already patched, per Metabase) and self-hosted instances below version 58, which Metabase says are not vulnerable.

  1. Upgrade to the minimum safe point release for your major version (e.g. metabase/metabase:v0.63.5) or later.
  2. If you cannot upgrade immediately, block /api/session/reset_password at your proxy or WAF.
  3. If the endpoint was publicly reachable: delete all rows from core_session in the application database to revoke sessions.

Read the brief →

Check exposure

· Vulnerability · CVE-2026-65400

macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass

Any Mac with Screen Sharing or Remote Management reachable from an untrusted network needs the update today and a compromise check; Macs with the service off should still update, but they were not reachable by this attack.

Must act: Owners of Macs with Screen Sharing or Remote Management enabled, especially hosted Mac mini or Mac Studio servers, CI build Macs and remotely administered machines with TCP 5900 reachable.

Can relax: Macs on the fixed releases, and Macs where Screen Sharing and Remote Management have stayed off (the default on fresh installs), which could not be reached through this flaw.

  1. Find every Mac listening on TCP 5900 (sudo lsof -iTCP:5900 -sTCP:LISTEN) and every Mac with Screen Sharing or Remote Management enabled.
  2. Update to macOS Tahoe 26.6.1 or later, Sequoia 15.7.9 or Sonoma 14.8.9 (softwareupdate -l, then sudo softwareupdate -i -a -R).
  3. Turn off Screen Sharing and Remote Management where they are not needed.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 1

Check: govulncheck ./...