CVE-2026-72898
Metabase SQL Injection Vulnerability
Description
CVE-2026-72898 is a maximum-severity SQL injection vulnerability in Metabase that lets a remote, unauthenticated attacker inject arbitrary SQL through the /reset_password endpoint and gain full administrator access to the affected Metabase instance. Metabase is a widely used open-source business intelligence and analytics platform, so a successful attack exposes connected databases, dashboards, and every data source the instance can reach. Because exploitation requires no authentication, no privileges, and no user interaction, and because the flaw can affect resources beyond the vulnerable component, it carries the highest possible CVSS 3.1 score of 10.0. CISA has added CVE-2026-72898 to its Known Exploited Vulnerabilities catalog, confirming that this SQL injection vulnerability is being actively exploited and must be remediated immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| metabase | metabase | >= 0.58.0, < 0.58.24; >= 0.59.0, < 0.59.21; >= 0.60.0, < 0.60.17; >= 0.61.0, < 0.61.11; >= 0.62.0, < 0.62.9; >= 0.63.0, < 0.63.5; >= 1.58.0, < 1.58.24; >= 1.59.0, < 1.59.21; >= 1.60.0, < 1.60.17; >= 1.61.0, < 1.61.11; >= 1.62.0, < 1.62.9; >= 1.63.0, < 1.63.5 |
References
- https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf(Mitigation, Patch, Vendor Advisory)
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json(Third Party Advisory)
- https://www.cve.org/CVERecord?id=CVE-2026-72898(VDB Entry)
- https://www.metabase.com/blog/security-update(Mitigation, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL injection occurs when an application builds a database query using externally influenced input without properly neutralizing special elements that alter the intended SQL command. In CVE-2026-72898, unsanitized input sent to the Metabase /reset_password endpoint is incorporated directly into a database query, allowing an attacker to manipulate the query and escalate to administrator access.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact Analysis
The impact of CVE-2026-72898 is catastrophic: with an attack vector of network, the flaw is remotely exploitable without physical access, and with low attack complexity it can be triggered without special conditions. No privileges and no user interaction are required, so any unauthenticated attacker who can reach the instance can exploit it. Because the scope is changed, a successful exploit can affect resources beyond the vulnerable component — in practice, the databases and systems connected to Metabase — and the high impact to confidentiality, integrity, and availability means an attacker can read, modify, and destroy data as well as seize administrative control. Rated CVSS 10.0 (Critical) with an EPSS score of roughly 10% (95th percentile) and active exploitation confirmed by CISA, this vulnerability represents an emergency-level risk that demands immediate action.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-72898 by adding it to the Known Exploited Vulnerabilities catalog, so defenders should assume this SQL injection is being used against exposed Metabase instances right now. The EPSS score of approximately 10% (95th percentile) indicates a high probability of exploitation activity relative to the broader vulnerability landscape. A vendor security advisory and a coordinated CSAF advisory are published, and while the KEV ransomware flag is currently "Unknown," the combination of unauthenticated remote access, a maximum CVSS score of 10.0, and confirmed in-the-wild use makes immediate patching essential. Given the low complexity and the public technical detail available through the Metabase GHSA advisory, working exploit techniques should be presumed to exist.
Remediation
- Apply the vendor fix immediately. Following CISA's KEV required action, apply mitigations per Metabase's instructions and comply with BOD 26-04 guidance; if a fix cannot be applied, discontinue use of the affected instance.
- Upgrade to a patched Metabase release for your branch. Update to at least Metabase 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (and the corresponding Enterprise builds 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5) depending on the release line you run.
- Restrict network exposure of the Metabase instance by placing it behind a VPN or IP allowlist and blocking unauthenticated internet access to endpoints such as
/reset_passworduntil patched. - Use parameterized queries and least-privilege database accounts as a defense-in-depth measure so that the account Metabase uses to reach connected databases cannot perform administrative operations.
- Review logs for indicators of compromise, including unexpected
/reset_passwordrequests, unusual admin logins, and anomalous queries against connected data sources, and rotate credentials for any database reachable by the instance.
Technical Details
CVE-2026-72898 is a SQL injection (CWE-89) reachable through the Metabase /reset_password database endpoint, where attacker-supplied input is concatenated into an SQL command instead of being passed as a bound parameter. This allows an attacker to break out of the intended query and inject arbitrary SQL, which the vulnerability description states can be leveraged to gain administrator access to the connected Metabase instance. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H confirms the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, while the changed scope reflects that the compromise extends beyond Metabase itself to the databases and resources it can query. Because Metabase brokers access to multiple back-end data sources, injection at this layer can cascade into broad data exposure and manipulation across the connected environment.
Frequently Asked Questions
Is CVE-2026-72898 being actively exploited?
Yes. CISA has added CVE-2026-72898 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Its EPSS score of about 10% (95th percentile) further indicates a high likelihood of ongoing exploitation activity, though the ransomware association is currently unknown.
What products are affected by CVE-2026-72898?
The vulnerability affects Metabase across multiple release branches: open-source versions 0.58.0–0.58.23, 0.59.0–0.59.20, 0.60.0–0.60.16, 0.61.0–0.61.10, 0.62.0–0.62.8, and 0.63.0–0.63.4, along with the equivalent Enterprise 1.x builds. Instances running these versions and exposing the /reset_password endpoint are at risk.
How do I fix CVE-2026-72898?
Upgrade to a patched release for your branch — for example 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (or the matching 1.x Enterprise build) — and follow CISA's KEV guidance under BOD 26-04. Until patched, restrict network access to the instance and review logs for suspicious /reset_password activity.
How severe is CVE-2026-72898?
It is Critical, with the maximum CVSS 3.1 base score of 10.0. The vulnerability is unauthenticated, network-exploitable, requires no user interaction, has a changed scope that extends impact beyond Metabase, and causes high confidentiality, integrity, and availability impact — placing it among the highest-priority vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.