---
title: "Security digest: August 6, 2026"
url: https://erroneo.us/security/2026-08-06/
description: "August 6, 2026 vulnerability digest: 2 briefs (Metabase CVE-2026-72898: Exploited Pre-Auth SQL…); 1 critical advisory (Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-06
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 6, 2026

2 editorial briefs and 1 critical advisory.

## Take stock

- Act now: Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection . Anyone self-hosting Metabase OSS or Enterprise version 58 or later below 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5 (1.x for Enterprise).
- Check exposure: macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass . Owners of Macs with Screen Sharing or Remote Management enabled, especially hosted Mac mini or Mac Studio servers, CI build Macs and remotely administered machines with TCP 5900 reachable.
- Go: 1 critical advisory ( github.com/traefik/traefik/v2 , github.com/traefik/traefik/v3 , github.com/traefik/traefik ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection](https://erroneo.us/security/briefs/metabase-cve-2026-72898-reset-password-sqli/index.md): Self-hosted Metabase 58 through 63 below the fixed point releases can be taken over without a login and was attacked as a zero-day; upgrade now, and if the reset endpoint was reachable, assume your connected database credentials are burned.
- **Check exposure** [macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass](https://erroneo.us/security/briefs/macos-screen-sharing-auth-bypass-cve-2026-65400/index.md): Any Mac with Screen Sharing or Remote Management reachable from an untrusted network needs the update today and a compromise check; Macs with the service off should still update, but they were not reachable by this attack.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-65600](https://erroneo.us/security/cve/CVE-2026-65600/index.md) Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware — Go github.com/traefik/traefik/v2 <= 2.11.51 → 2.11.52; Go github.com/traefik/traefik/v3 <= 3.6.22 → 3.6.23; Go github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.6 → 3.7.7

---
Source page: https://erroneo.us/security/2026-08-06/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt