CVE-2026-72898
published 2026-08-10CVE-2026-72898: Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the…
PriorityP1100critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-14
Exploited in the wild
EPSS
79.22%
99.6th percentile
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| metabase | metabase | >= 0.58.0 < 0.58.24 | 0.58.24 |
| metabase | metabase | >= 0.59.0 < 0.59.21 | 0.59.21 |
| metabase | metabase | >= 0.60.0 < 0.60.17 | 0.60.17 |
| metabase | metabase | >= 0.61.0 < 0.61.11 | 0.61.11 |
| metabase | metabase | >= 0.62.0 < 0.62.9 | 0.62.9 |
| metabase | metabase | >= 0.63.0 < 0.63.5 | 0.63.5 |
| metabase | metabase | >= 1.58.0 < 1.58.24 | 1.58.24 |
| metabase | metabase | >= 1.59.0 < 1.59.21 | 1.59.21 |
| metabase | metabase | >= 1.60.0 < 1.60.17 | 1.60.17 |
| metabase | metabase | >= 1.61.0 < 1.61.11 | 1.61.11 |
| metabase | metabase | >= 1.62.0 < 1.62.9 | 1.62.9 |
| metabase | metabase | >= 1.63.0 < 1.63.5 | 1.63.5 |
| metabase | metabase | >= x.58.0 < x.58.24 | x.58.24 |
| metabase | metabase | >= x.59.0 < x.59.21 | x.59.21 |
| metabase | metabase | >= x.60.0 < x.60.17 | x.60.17 |
| metabase | metabase | >= x.61.0 < x.61.11 | x.61.11 |
| metabase | metabase | >= x.62.0 < x.62.9 | x.62.9 |
| metabase | metabase | >= x.63.0 < x.63.5 | x.63.5 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Metabase up to x.63.4 Password Reset sql injection
vuldb·2026-08-11·CVSS 10.0
CVE-2026-72898 [CRITICAL] Metabase up to x.63.4 Password Reset sql injection
A vulnerability classified as critical was found in Metabase up to x.63.4. This issue affects some unknown processing of the component Password Reset. Such manipulation leads to sql injection.
This vulnerability is uniquely identified as CVE-2026-72898. The attack can be launched remotely. Moreover, an exploit is present.
Upgrading the affected component is advised.
VulnCheck
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2026·CVSS 10.0
CVE-2026-72898 [CRITICAL] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Affected: Metabase Metabase
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.metabase.com/blog/security-update; https://kevintel.com/CVE-2026-72898
CISA
Metabase SQL Injection Vulnerability
cisa·2026-08-11·CVSS 10.0
CVE-2026-72898 [CRITICAL] CWE-89 Metabase SQL Injection Vulnerability
Vulnerability: Metabase SQL Injection Vulnerability
Affected: Metabase Metabase
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services o
No detection rules found.
Nuclei
Metabase - Unauthenticated SQL Injection
nuclei·CVSS 10.0
CVE-2026-72898 [CRITICAL] Metabase - Unauthenticated SQL Injection
Metabase - Unauthenticated SQL Injection
Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.
Template:
id: CVE-2026-72898
info:
name: Metabase - Unauthenticated SQL Injection
author: 0x_Akoko,pdteam
severity: critical
description: |
Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.
impact: |
Remote unauthenticated attackers can execute arbitrary SQL and gain administrator access to the Metabase instance.
remediation: |
Update to the latest
No writeups or analysis indexed.
https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjfhttps://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.jsonhttps://www.cve.org/CVERecord?id=CVE-2026-72898https://www.metabase.com/blog/security-updatehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898
2026-08-10
Published
2026-08-11
Added to CISA KEV
Exploited in the wild