📊 HiddenMerit Morning Post · Issue 72

Focus on Database Frontiers, Practical Insights for DBAs August 10, 2026 ｜ 5 Selected Global Breaking News

01｜Metabase Exposes CVSS 10.0 Zero‑Day SQL Injection: Actively Exploited in the Wild, Self‑Hosted Instances Require Immediate Patching

On August 6, open‑source BI platform Metabase disclosed a zero‑day SQL injection vulnerability that is being actively exploited in the wild, with a CVSS score of 10.0 (the highest risk level). No CVE has yet been assigned. Attackers can inject arbitrary SQL commands into the database via the /api/session/reset_password endpoint without any authentication, gaining administrator privileges, stealing stored credentials to connected databases, and reading and exporting data.

Impact and Fix: Affected versions cover branches 1.58 through 1.63. Patched versions include: 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. Metabase Cloud customers have been automatically patched by the vendor; self‑hosted instances must be manually updated by users. A temporary mitigation measure is to block the /api/session/reset_password endpoint.

Compromise Indicators: Security teams should monitor for access patterns where a POST /api/session/reset_password returns a 400 status code, followed immediately by a GET /api/user/current returning 200. If this pattern is detected, the instance is highly likely compromised. After patching, immediately revoke all active sessions (delete the core_session table), review administrator accounts, and rotate all credentials for connected databases.

• DBA Perspective: This is the highest‑level security alert in the database domain. All organisations using Metabase self‑hosted instances should immediately take three actions: upgrade to the patched version, immediately revoke all active user sessions, and rotate all credentials to connected databases. A CVSS 10.0 vulnerability should not be treated as “need to fix soon” but as an emergency security incident that has “already been weaponised by adversaries.”

02｜OceanBase Launches First External Funding Round: Targeting RMB 2‑3 Billion, Annualized Revenue Exceeds RMB 1.4 Billion

Ant Group’s independent database company OceanBase has officially launched its Series A funding round, targeting approximately RMB 2‑3 billion, and has already engaged with multiple leading investment institutions. This marks the first time OceanBase has introduced external funding since its establishment.

Key Data: In 2026, OceanBase’s annualized revenue has exceeded RMB 1.4 billion, representing approximately 70% year‑on‑year growth. The company has thousands of customers, primarily including Bank of Communications and China Mobile, and has begun expanding into Southeast Asia, Japan, India, and Latin America. According to IDC data, OceanBase ranked first in market share for distributed database on‑premises deployment in China in 2025.

Strategic Upgrade: This funding round will be used to enhance independent operational capabilities and accelerate its transformation toward an AI data platform. The “lakehouse‑integrated” AI database released in June has been tested in dozens of customer scenarios. In 2024, OceanBase established an independent board of directors and an employee equity incentive mechanism, laying the foundation for independent operations and external funding.

Three Ant Group subsidiaries have now initiated independent financing: Ant International completed a Series A round of approximately $1.2 billion in July, and Ant Digital is preparing for a Pre‑IPO round. This signals that Ant‑incubated businesses are progressively establishing independent governance and financing mechanisms.

• DBA Perspective: OceanBase’s first external funding is a landmark event for domestic databases moving toward “market‑oriented independent operations.” The annualized revenue exceeding RMB 1.4 billion and 70% growth validate the commercial maturity of domestic distributed databases. The AI data platform transformation direction means DBA skills need to expand from “distributed database operations” to “AI data platform architecture and multi‑modal data management.”

03｜Dameng Receives Another Major Shareholder Increase: CEC Investment Shareholding Rises to 26.96%

On August 7, Dameng announced that shareholder CEC Investment Holdings Co., Ltd. increased its shareholding by 2,217,000 shares (representing 1.96% of total share capital) via block trading on August 6. After this increase, the combined shareholding of CEC Investment and its concert party China Software rose from 25.00% to 26.96% , with the equity change reaching a 1% multiple.

This increase was implemented by China Electronics Corporation Group through its wholly‑owned subsidiary CEC Investment, based on “strong confidence in the company’s future sustainable and stable development,” with all funds coming from its own capital. On July 28, CEC Investment had already increased its shareholding by 11,758 shares via block trading, raising its holding from 24.99% to 25.00%. Dameng’s 2025 revenue was RMB 1.306 billion, with net profit of RMB 515 million.

• DBA Perspective: Two increases within a month, with the shareholding breaking through 25% and approaching 27% within days, sends a strong signal of continued bullishness from industrial capital toward leading domestic database vendors. The strong endorsement from China Electronics Corporation, a key state‑owned enterprise, provides confidence in ecosystem stability for DBAs selecting Dameng products in Xinchuang projects in finance, government, and other sectors.

04｜TimescaleDB Exposes Out‑of‑Bounds Read Vulnerability (CVE-2026-70634): Compressed Table Attackers Can Leak Shared Buffer Pool

On August 7, VulDB disclosed an out‑of‑bounds read vulnerability in TimescaleDB (CVE-2026-70634), affecting versions up to 2.29.1.

Vulnerability Details: The vulnerability resides in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates decoded indexes, while the reverse path relies on assertions that are compiled out in release builds, resulting in 64‑bit Simple8b indexes not being validated, with read offsets controllable by attackers. An attacker with DML privileges on physical compressed tables can store crafted data and execute reverse order scans. For pass‑by‑value column types, out‑of‑bounds Datum values are returned to the client as normal column values, leaking backend memory (including the shared buffer pool), a leakage path not covered by SQL access controls.

Fix: TimescaleDB 2.29.1 and above include the fix. The community has also discovered another related vulnerability, CVE-2026-70635, involving information disclosure in the Bulk Text Dictionary Decompression component.

• DBA Perspective: This vulnerability reveals the complexity and security risks of modern database compression algorithms – seemingly independent compression modules can bypass traditional SQL access controls when processing user data, leaking cross‑query cached data from the shared buffer pool. Low‑privilege users with DML permissions can trigger this. DBAs using TimescaleDB should immediately upgrade to 2.29.1 or higher and apply least‑privilege controls to DML permissions on compressed tables.

05｜MariaDB Exposes Authenticated RCE Vulnerability (QVD-2026-48306, CVSS 8.8): Low‑Privilege Account Can Escalate to DBA with One SQL Statement

QiAnXin CERT has detected an authenticated remote code execution vulnerability in MariaDB (QVD-2026-48306, CVSS 8.8), stemming from the combination of GRANT PROXY privilege escalation (F-09) and SYS_REFCURSOR use‑after‑free (F-05) .

Vulnerability Details: An attacker with any low‑privilege account (even one with only USAGE privileges) can escalate to DBA through a single GRANT PROXY statement, then exploit a memory release flaw related to stored procedures/cursors to trigger a use‑after‑free condition, ultimately achieving arbitrary code execution and gaining control of the server host. The entire attack can be carried out using only SQL statements, without any operating system‑level interaction. PoC and technical details for this vulnerability have been publicly disclosed.

Impact Scope: Affected domestic risk assets total 17,437, with global risk assets totaling 520,605. Affects MariaDB 13.0.1‑rc and multiple stable versions. Official Docker images for many production and testing environments are also affected.

Remediation Recommendations: Upgrade to supported stable versions; restrict port 3306 to internal networks only; use least‑privilege controls to disable high‑risk stored procedure/function creation and FILE privileges.

• DBA Perspective: The attack path of this vulnerability deserves high vigilance – a low‑privilege account can complete privilege escalation to operating system‑level code execution using only SQL statements. As a MySQL fork, MariaDB is widely deployed in internet applications, cloud‑native, and big data analytics scenarios. DBAs should immediately check MariaDB versions and risk assets, upgrade to the latest stable version or roll back to unaffected versions, and implement strict network access controls on port 3306 exposed to the public internet.

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is CVSS 10.0?

CVSS 10.0 is the highest risk rating in the Common Vulnerability Scoring System. The Metabase zero‑day vulnerability is at this level, meaning the vulnerability satisfies all of the following conditions:

CVSS Metric	Meaning	Metabase Zero‑Day Status
AV:N	Remotely exploitable over network	Attackable from the public internet
AC:L	Low exploitation difficulty, no special conditions	No additional conditions required
PR:N	No authentication required	Any attacker can trigger
UI:N	No user interaction required	No clicks or actions needed
S:C	Scope changed – affects associated systems	Can move laterally into internal networks
C:H/I:H/A:H	Complete loss of confidentiality/integrity/availability	Data breach + system control

CVSS 10.0 means: An attacker can fully compromise the target system with just network access, without any credentials or user interaction. A CVSS 10.0 vulnerability should not be treated as “need to fix soon” but as an emergency security incident that has “already been weaponised.”

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.