--- title: Metabase 0-day actively exploited, ClickHouse 26.7 ships... description: A critical SQL injection 0-day in Metabase 1.58+ is being actively exploited against Cloud instances — self-hosted users need to patch immediately. ClickHouse... canonical: https://daily.dev/posts/metabase-0-day-actively-exploited-clickhouse-26-7-ships-313x-group-by-speedup-bzrrezpez twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Metabase 0-day actively exploited, ClickHouse 26.7 ships 313x GROUP BY speedup | daily.dev og:description: A critical SQL injection 0-day in Metabase 1.58+ is being actively exploited against Cloud instances — self-hosted users need to patch immediately. ClickHouse... og:url: https://daily.dev/posts/metabase-0-day-actively-exploited-clickhouse-26-7-ships-313x-group-by-speedup-bzrrezpez og:image: https://api.daily.dev/og/posts/BzRrEzPez.png og:image:alt: Metabase 0-day actively exploited, ClickHouse 26.7 ships 313x GROUP BY speedup og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Metabase 0-day actively exploited, ClickHouse 26.7 ships 313x GROUP BY speedup **[Databases Digest](https://daily.dev/sources/databases_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary A critical SQL injection 0-day in Metabase 1.58+ is being actively exploited against Cloud instances — self-hosted users need to patch immediately. ClickHouse 26.7 landed with a 313x speedup for GROUP BY/ORDER BY/LIMIT queries and significant JOIN improvements. Doltgres hit 1.0 with a stability guarantee and 99% Postgres compatibility verified against 5.6 million queries. MySQL 26.7.0 adds post-quantum cryptography for TLS connections and ships the first community-contributed patch. ## Content **TLDR:** A critical SQL injection 0-day in Metabase 1.58+ is being actively exploited against Cloud instances — self-hosted users need to patch immediately. ClickHouse 26.7 landed with a 313x speedup for GROUP BY/ORDER BY/LIMIT queries and significant JOIN improvements. Doltgres hit 1.0 with a stability guarantee and 99% Postgres compatibility verified against 5.6 million queries. MySQL 26.7.0 adds post-quantum cryptography for TLS connections and ships the first community-contributed patch. --- ## Metabase 0-day: active SQL injection exploit against application database A critical 0-day in Metabase versions 1.58 and above allows attackers to inject arbitrary SQL against the Metabase application database, potentially granting admin access and exposing stored database credentials. Metabase Cloud is already patched. Self-hosted users must upgrade to the minimum safe release for their branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5. The attack pattern is a POST to /api/session/reset_password returning 400 followed by a GET to /api/user/current returning 200 — if that endpoint is publicly accessible, run TRUNCATE TABLE core_session after upgrading. [Read more](https://daily.dev/posts/M1ITh081A) ## ClickHouse 26.7: 313x GROUP BY speedup, major JOIN and vector search improvements ClickHouse 26.7 ships 61 new features and 329 bug fixes. The headline is a 313x speedup for GROUP BY ... ORDER BY ... LIMIT queries via a fused streaming pipeline with early termination. JOIN improvements include build-side granule pruning (6.2x speedup) and packed row references (12-21% faster hash joins). Vector search gains Int8 QBit quantization and randomized Hadamard rotations. The new EXPLAIN ANALYZE command finally exposes actual execution metrics rather than estimates. [Read more](https://daily.dev/posts/8DsPRK7Ep) ## Doltgres 1.0: version-controlled Postgres with forward storage compatibility guarantee Doltgres, the Postgres-compatible version-controlled database, reached 1.0. The release commits to four things: no breaking storage changes in any 1.x release, OLTP-viable query performance (about 2.7x slower than Postgres), 99% Postgres compatibility verified against 5.6 million SQL queries and 20+ client libraries, and a stable version control interface via system tables. Roadmap includes PostGIS, vector indexes, and row-level security. [Read more](https://daily.dev/posts/DnJnQEAn4) ## MySQL 26.7.0: post-quantum cryptography, new versioning scheme, community patch merged MySQL 26.7.0 is the first release under the new calendar-versioning model (YY.M.P) and adds post-quantum cryptography for TLSv1.3 connections using OpenSSL 3.5's ML-KEM hybrid key exchange groups. The Change Stream Applier enables multithreaded replication with up to 1,024 worker threads per channel. The Thread Pool Plugin is now available in Community Edition. The first community-contributed patch — a composite primary key chunking fix from Percona — is already merged. [Read more](https://daily.dev/feed-by-ids?id=AsKmfmYil&id=jz69NDTTC&id=u9sqNSkUA) --- ## Also notable - **MySQL GTID fatal error 1236: crash recovery and the 8.0.17 durability fix:** MySQL replication fatal error 1236 — where a replica has more GTIDs than its source after a primary crash with sync_binlog != 1 — can cause silent data corruption if handled by naively restarting replication; MySQL 8.0.17 introduced GTID persistence in InnoDB UNDO log headers that makes the empty-transaction workaround obsolete, but the correct response to a crashed primary is still to promote a healthy replica and restore from backup. [Read more](https://daily.dev/feed-by-ids?id=3ZnrQ1Oru&id=0kTRivpZL) - **Amazon ElastiCache Graviton4 nodes: up to 47% higher throughput, 43% lower P99 latency:** ElastiCache M8g, R8g, and C8gn nodes based on Graviton4 deliver up to 47% higher throughput and 43% lower P99 latency versus equivalent Graviton3 nodes, with C8gn supporting up to 200 Gbps network bandwidth — available now across 30+ AWS regions. [Read more](https://daily.dev/posts/Lb5tO8UFd) - **Neon Object Storage beta: S3-compatible buckets that branch with your Postgres database:** Neon launched S3-compatible object storage in beta that forks alongside Postgres branches using copy-on-write semantics, meaning branching is instant regardless of data size and standard AWS SDK/boto3/CLI tooling works without modification. [Read more](https://daily.dev/posts/o1DC0ZJ6R) - **Amazon RDS exposes storage initialization progress via StorageOperationStatus and StorageOperationPercentProgress:** RDS now surfaces StorageOperationStatus and StorageOperationPercentProgress on the console and DescribeDBInstances API, letting you know when a restored snapshot or new read replica has finished initializing storage and is actually delivering full provisioned IOPS — previously there was no signal for this. [Read more](https://daily.dev/posts/fPhGrPFA5) - **DacFx 170.5-preview: .dacpac publish time drops from 20+ seconds to ~2 seconds:** DacFx 170.5.60-preview adds fast comparison via a new __DacFxDeploymentHistory system table that caches the model checksum, cutting SqlPackage publish times from 20+ seconds to roughly 2 seconds on unchanged deployments — enabled with /p:LogDeployment=true and /p:EnableFastComparison=true. [Read more](https://daily.dev/posts/V5pajiwa7) ## Similar posts on daily.dev - [ClickHouse Release 26.7](https://daily.dev/posts/clickhouse-release-26-7-8dsprk7ep) · ClickHouse · 3 upvotes · 0 comments - [ClickHouse release 26.9](https://daily.dev/posts/clickhouse-release-26-9-gdie8gpos) · ClickHouse · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#backend](https://daily.dev/tags/backend), [#postgresql](https://daily.dev/tags/postgresql), [#mysql](https://daily.dev/tags/mysql), [#clickhouse](https://daily.dev/tags/clickhouse) [View this post on daily.dev](https://daily.dev/posts/metabase-0-day-actively-exploited-clickhouse-26-7-ships-313x-group-by-speedup-bzrrezpez) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/metabase-0-day-actively-exploited-clickhouse-26-7-ships-313x-group-by-speedup-bzrrezpez","headline":"Metabase 0-day actively exploited, ClickHouse 26.7 ships 313x GROUP BY speedup","text":"A critical SQL injection 0-day in Metabase 1.58+ is being actively exploited against Cloud instances — self-hosted users need to patch immediately. ClickHouse 26.7 landed with a 313x speedup for GROUP BY/ORDER BY/LIMIT queries and significant JOIN improvements. Doltgres hit 1.0 with a stability guarantee and 99% Postgres compatibility verified against 5.6 million queries. MySQL 26.7.0 adds post-quantum cryptography for TLS connections and ships the first community-contributed patch.","url":"https://daily.dev/posts/metabase-0-day-actively-exploited-clickhouse-26-7-ships-313x-group-by-speedup-bzrrezpez","datePublished":"2026-08-07T04:17:57.145Z","dateModified":"2026-08-07T04:18:26.506Z","author":{"@type":"Organization","name":"Databases Digest","logo":"https://media.daily.dev/image/upload/s--ir1hdV8b--/f_auto,q_auto/v1773839400/logos/databases_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/databases_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/databases_digest","name":"Databases Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Databases Digest","item":"https://daily.dev/sources/databases_digest"},{"@type":"ListItem","position":3,"name":"Metabase 0-day actively exploited, ClickHouse 26.7 ships 313x GROUP BY speedup"}]} ```