SQL Injection Vulnerability in Metabase Affects Data Security
CVE-2026-72899

10CRITICAL

Key Information:

Vendor

Metabase

Status
Metabase
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72899?

A vulnerability in Metabase enables unauthenticated users to execute arbitrary SQL commands through shared cards or dashboards, compromising data integrity and security. This issue arises specifically when a field-filter parameter is publicly exposed, allowing potential attackers to exploit the data environment without any form of user authentication.

Affected Version(s)

Metabase x.58.0

Metabase x.59.0

Metabase x.60.0

References

https://github.com/metabase/metabase/security/advisories/...
vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-72899
vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.