SQL Injection Vulnerability in Metabase by Metabase, Inc.
CVE-2026-72898

10CRITICAL

Key Information:

Vendor

Metabase

Status
Metabase
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72898?

Metabase contains a vulnerability that enables a remote, unauthenticated attacker to perform SQL injection through the '/reset_password' endpoint. This flaw allows attackers to manipulate database queries, potentially gaining unauthorized administrator access to the Metabase instance and compromising sensitive data.

Affected Version(s)

Metabase x.58.0

Metabase x.59.0

Metabase x.60.0

References

https://github.com/metabase/metabase/security/advisories/...
vendor-advisory
https://www.metabase.com/blog/security-update
vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-72898
vdb-entry

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.