📊 HiddenMerit Morning Post · Issue 71
Focus on Database Frontiers, Practical Insights for DBAs August 8, 2026 ｜ 5 Selected Global Breaking News
01｜Metabase Exposes CVSS 10.0 Zero‑Day SQL Injection: Actively Exploited, Self‑Hosted Instances Require Urgent Patching
On August 6, open‑source BI platform Metabase disclosed a zero‑day SQL injection vulnerability that is being actively exploited in the wild, with a CVSS score of 10.0 (highest risk level), and no CVE has yet been assigned. Attackers can inject arbitrary commands into the database via the /api/session/reset_password endpoint without any authentication, thereby gaining administrator privileges, stealing credentials to connected databases, and extracting data.
Impact and Fix: Affected versions cover branches 1.58 through 1.63. Patched versions include: 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. Metabase Cloud customers have been automatically upgraded by the vendor; self‑hosted instances must be manually updated by users. Temporary mitigation: an access pattern where a GET to /api/user/current succeeds immediately after a 400 response from /api/session/reset_password should be treated as a potential sign of compromise.
- DBA Perspective: This is the highest‑level security alert in the database domain (CVSS 10.0). All organisations using Metabase self‑hosted instances should immediately take three actions: upgrade to the patched version, immediately revoke all active user sessions, and rotate all credentials to connected databases. A compromised Metabase instance can serve as a “bridge” for attackers to enter enterprise internal networks – once an analytics platform is compromised, all data sources it connects to are potentially exposed. Even without evidence of compromise, instances should not be considered safe.
02｜Dameng Receives Another Major Shareholder Increase: CEC Investment Shareholding Rises to 26.96%
On the evening of August 7, Dameng announced that shareholder CEC Investment Holdings Co., Ltd. increased its shareholding by 2,217,000 shares (representing 1.96% of total share capital) via block trading on August 6. After this increase, the combined shareholding of CEC Investment and its concert party China Software rose from 25.00% to 26.96% , with the equity change reaching a 1% multiple.
As previously reported in Issue 64, CEC Investment increased its shareholding by 11,758 shares on July 28 via block trading, raising its holding from 24.99% to 25.00%. This latest increase was implemented by China Electronics Corporation Group through its wholly‑owned subsidiary CEC Investment, based on strong confidence in the company’s future sustainable and stable development. All funds for the increase came from its own capital. Dameng’s 2025 revenue was RMB 1.306 billion, with net profit of RMB 515 million.
- DBA Perspective: Two increases within a month, with the shareholding breaking through 25% and approaching 27% within days, sends a strong signal of continued bullishness from industrial capital toward leading domestic database vendors. The strong endorsement from China Electronics Corporation, a key state‑owned enterprise, provides confidence in ecosystem stability for DBAs selecting Dameng products in Xinchuang projects in finance, government, and other sectors.
03｜NineYou Database “Trusted Multi‑Modal AI Data Infrastructure” Passes Technology Assessment: Dual‑Distributed Architecture Reaches World‑Leading Level
On August 5, the joint project “Key Technologies and Applications of Trusted Multi‑Modal AI Data Infrastructure” by Shenzhen NineYou Database Co., Ltd. and Peking University successfully passed a technology achievement assessment organised by the Advanced Technology Achievement Transfer Center of Western China. The expert panel was chaired by Zhang Jingzhong, an academician of the Chinese Academy of Sciences, and unanimously agreed that the achievement overall reaches the domestic leading level, with the dual‑distributed architecture and heterogeneous replica technologies reaching world‑leading level.
Core Technology Breakthroughs: The project addresses the strategic need for domestic replacement in critical sectors, with independent breakthroughs in key technologies including dual‑distributed architecture and intelligent routing for heterogeneous replicas, multi‑modal hyper‑convergence with cross‑modal strong consistency, and AI‑native security‑converged kernel architecture. The achievement has obtained 21 invention patents and 24 software copyrights, and participated in the development of 10 industry and group standards. It has been deployed at scale in key industries including finance, government, energy, maritime, and transportation, with full‑stack adaptation to the Xinchuang ecosystem including Kunpeng, Hygon, Kylin, and UnionTech.
NineYou Database previously launched a database product covering 9 full data modalities, including structured, unstructured, semi‑structured, time‑series, spatial, search, memory, vector, and graph data.
- DBA Perspective: NineYou Database’s successful technology assessment provides academician‑level authoritative endorsement for domestic multi‑modal AI databases at the core technology level. The conclusion that the “dual‑distributed architecture” has reached world‑leading level means that domestic hyper‑converged databases now have the technical confidence to benchmark against mainstream international products in distributed architecture design. For DBAs, this provides a reference benchmark for evaluating the technical maturity of multi‑modal databases in Xinchuang selection. The 21 invention patents and product matrix covering 9 full modalities remind DBAs that when evaluating emerging database vendors, they should pay attention to their core technology patent portfolios and the breadth of multi‑modal data model support.
04｜Bank of China and ICBC Receive Database Invention Patents on the Same Day: Major Bank Fintech Acceleration
On August 7, Bank of China and Industrial and Commercial Bank of China (ICBC) received database‑related invention patents on the same day.
Bank of China received a patent for “Database processing method, device, computer equipment, and storage medium” (CN202310841963.3). The method includes: obtaining update information for multiple update events of a target database, generating an update table based on the update information, receiving update query information through a query interface, and returning matching records – aimed at improving database maintenance efficiency.
ICBC received a patent for “Database synchronisation method and device, storage medium, and electronic device” (CN202310286762.1). The method includes: synchronising target data from a first database to a second database according to an initial synchronisation method, matching the abnormal type of synchronisation anomalies, adjusting the synchronisation method based on the abnormal type, and resynchronising – solving the problem of low correctness during data synchronisation.
- DBA Perspective: Two major state‑owned banks receiving database patents on the same day signals the acceleration of “autonomous database technology reserve” in the financial industry. ICBC has received 909 patent grants this year, up 5.33% year‑on‑year. For DBAs, this means that fintech positions are demanding deeper database technology expertise – future bank DBAs will not only need operations capabilities but also technical vision in database toolchain development and adaptive anomaly recovery during synchronisation. The patent directions of “adaptive adjustment for data synchronisation anomalies” and “update information query interface” may gradually be incorporated into the daily operational tools of bank DBAs.
05｜TimescaleDB Exposes Out‑of‑Bounds Read Vulnerability (CVE-2026-70634): Compressed Table Attackers Can Read Shared Buffer Pool
On August 7, VulDB disclosed an out‑of‑bounds read vulnerability in TimescaleDB (CVE-2026-70634), affecting versions up to 2.29.1. The vulnerability resides in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c) – the forward path validates decoded indexes, while the reverse path relies on assertions that are compiled out in release builds, resulting in 64‑bit Simple8b indexes not being validated, with read offsets controllable by attackers.
Impact: An attacker with DML privileges on physical compressed tables can store crafted data and execute reverse order scans. For pass‑by‑value column types, out‑of‑bounds Datum values are returned to the client as normal column values, leaking backend memory (including the shared buffer pool), a leakage path not covered by SQL access controls.
Fix: TimescaleDB 2.29.1 and above include the fix.
- DBA Perspective: This vulnerability reveals the complexity and security risks of modern database compression algorithms – seemingly independent compression modules can bypass traditional SQL access controls when processing user data, leaking cross‑query cached data from the shared buffer pool. Low‑privilege users with DML permissions can trigger this. DBAs using TimescaleDB should immediately upgrade to 2.29.1 or higher and apply least‑privilege controls to DML permissions on compressed tables.
📚 SQL Little Knowledge Point
This Issue’s Knowledge Point: What is CVSS 10.0?
CVSS 10.0 is the highest risk rating in the Common Vulnerability Scoring System. The Metabase zero‑day (no CVE yet but CVSS 10.0) means the vulnerability satisfies all of the following conditions:
| CVSS Metric | Metabase Zero‑Day Status | Meaning |
|---|---|---|
| Attack Vector (AV:N) | Remotely exploitable over network | Attackable from the public internet |
| Attack Complexity (AC:L) | No special conditions required | Low exploitation difficulty |
| Privileges Required (PR:N) | No authentication required | Any user can trigger |
| User Interaction (UI:N) | No user action required | No clicks or actions needed from victims |
| Scope (S:C) | Affects associated systems | Can move laterally into internal networks |
| C/I/A Impact | Complete loss | Data breach + system control |
CVSS 10.0 means: An attacker can fully compromise the target system with just network access, without any credentials or user interaction. CVSS 10.0 vulnerabilities should not be treated merely as “need to fix soon” but as “already weaponised by adversaries” emergency security incidents.
HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.