SQL Injection Vulnerability in Metabase by Metabase, Inc.
CVE-2026-72898
Key Information:
Badges
What is CVE-2026-72898?
CVE-2026-72898 is a significant vulnerability affecting Metabase, an open-source business intelligence tool designed to facilitate data analysis and visualization for organizations. This particular vulnerability is categorized as a SQL Injection flaw, which allows attackers to manipulate the SQL queries executed by the application. By targeting the vulnerable '/reset_password' database endpoint, a remote, unauthenticated attacker can inject arbitrary SQL statements. This capability may lead to unauthorized administrator access to the Metabase instance, granting the attacker control over the data and configurations of the application. The potential exploitation of this vulnerability poses a serious risk, as it could allow an attacker to exfiltrate sensitive data, modify existing records, or disrupt the operation of data services.
Potential impact of CVE-2026-72898
-
Unauthorized Access and Control: The vulnerability allows attackers to gain unauthorized administrative access to Metabase instances, enabling them to manipulate data, change configurations, and exert complete control over the application.
-
Data Exfiltration: By exploiting this flaw, attackers could access sensitive data stored within the Metabase environment, potentially leading to data breaches that might expose confidential organizational information, including customer data and trade secrets.
-
Operational Disruption: The ability to execute arbitrary SQL queries could result in significant operational disruptions, as attackers might delete or modify critical database entries, affecting data integrity and the overall functionality of data-driven processes within the organization.
CISA has reported CVE-2026-72898
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-72898 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Metabase x.58.0
Metabase x.59.0
Metabase x.60.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
TechtimesCVE-2026-72898Metabase SQL Injection Breached Five Companies, Exposed All Connected Database Credentials
Metabase SQL injection vulnerability gave unauthenticated attackers full admin access and downstream database credentials, breaching five companies. CISA added CVSS 10.0 CVE-2026-72898 and Cisco ASA
3 weeks ago
References
EPSS Score
79% chance of being exploited in the next 30 days.
CVSS V4
Timeline
- 📈
Vulnerability started trending
- 🟡
Public PoC available
- 📰
First article discovered by Techtimes
- 👾
Exploit known to exist
- 🦅
CISA Reported
Vulnerability published
Vulnerability Reserved