Database Exposure in Metabase Software by Metabase
CVE-2026-72900

7.1HIGH

Key Information:

Vendor

Metabase

Status
Metabase
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72900?

An authenticated low-privileged attacker can exploit a vulnerability in Metabase to gain unauthorized access to the entire application database. This flaw poses a significant risk as it allows sensitive data retrieval, potentially leading to broader security concerns for organizations using the software.

Affected Version(s)

Metabase x.58.0

Metabase x.59.0

Metabase x.60.0

References

https://github.com/metabase/metabase/security/advisories/...
vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-72900
vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.