CVE-2026-72898
published 2026-08-10CVE-2026-72898: Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the…
PriorityP1100critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-14
Exploited in the wild
EPSS
97.34%
99.9th percentile
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| metabase | metabase | >= 0.58.0 < 0.58.24 | 0.58.24 |
| metabase | metabase | >= 0.59.0 < 0.59.21 | 0.59.21 |
| metabase | metabase | >= 0.60.0 < 0.60.17 | 0.60.17 |
| metabase | metabase | >= 0.61.0 < 0.61.11 | 0.61.11 |
| metabase | metabase | >= 0.62.0 < 0.62.9 | 0.62.9 |
| metabase | metabase | >= 0.63.0 < 0.63.5 | 0.63.5 |
| metabase | metabase | >= 1.58.0 < 1.58.24 | 1.58.24 |
| metabase | metabase | >= 1.59.0 < 1.59.21 | 1.59.21 |
| metabase | metabase | >= 1.60.0 < 1.60.17 | 1.60.17 |
| metabase | metabase | >= 1.61.0 < 1.61.11 | 1.61.11 |
| metabase | metabase | >= 1.62.0 < 1.62.9 | 1.62.9 |
| metabase | metabase | >= 1.63.0 < 1.63.5 | 1.63.5 |
| metabase | metabase | >= x.58.0 < x.58.24 | x.58.24 |
| metabase | metabase | >= x.59.0 < x.59.21 | x.59.21 |
| metabase | metabase | >= x.60.0 < x.60.17 | x.60.17 |
| metabase | metabase | >= x.61.0 < x.61.11 | x.61.11 |
| metabase | metabase | >= x.62.0 < x.62.9 | x.62.9 |
| metabase | metabase | >= x.63.0 < x.63.5 | x.63.5 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Metabase up to x.63.4 Password Reset sql injection
vuldb·2026-08-11·CVSS 10.0
CVE-2026-72898 [CRITICAL] Metabase up to x.63.4 Password Reset sql injection
A vulnerability classified as critical was found in Metabase up to x.63.4. This issue affects some unknown processing of the component Password Reset. Such manipulation leads to sql injection.
This vulnerability is uniquely identified as CVE-2026-72898. The attack can be launched remotely. Moreover, an exploit is present.
Upgrading the affected component is advised.
VulnCheck
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2026·CVSS 10.0
CVE-2026-72898 [CRITICAL] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Affected: Metabase Metabase
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.metabase.com/blog/security-update; https://kevintel.com/CVE-2026-72898
CISA
Metabase SQL Injection Vulnerability
cisa·2026-08-11·CVSS 10.0
CVE-2026-72898 [CRITICAL] CWE-89 Metabase SQL Injection Vulnerability
Vulnerability: Metabase SQL Injection Vulnerability
Affected: Metabase Metabase
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services o
No detection rules found.
Nuclei
Metabase - Unauthenticated SQL Injection
nuclei·CVSS 10.0
CVE-2026-72898 [CRITICAL] Metabase - Unauthenticated SQL Injection
Metabase - Unauthenticated SQL Injection
Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.
Template:
id: CVE-2026-72898
info:
name: Metabase - Unauthenticated SQL Injection
author: 0x_Akoko,pdteam
severity: critical
description: |
Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.
impact: |
Remote unauthenticated attackers can execute arbitrary SQL and gain administrator access to the Metabase instance.
remediation: |
Update to the latest
Hackernews
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
blogs_hackernews·2026-10-08
CVE-2026-72898 Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said.
The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization.
JPCERT/CC called what it knows "limited and fragmentary" in the alert, translated here from Japanese. It said its account does not mean the same method was used in every in
Checkpoint
14th September – Threat Intelligence Report
blogs_checkpoint·2026-09-14·CVSS 10.0
CVE-2026-72898 [CRITICAL] 14th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 14th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 14th Setpember, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1. Exposed data included names and government identification numbers, while a criminal marketplace advertised a collection containing millions of identity documents, including driver’s licenses, associated with t
Recorded Future
August 2026 CVE Landscape
blogs_recorded_future·2026-09-08·CVSS 8.8
CVE-2025-62593 [HIGH] August 2026 CVE Landscape
## August 2026 CVE Landscape
In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation , 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month. 31 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 32 were reported in open sources and validated by Insikt Group, seven were sourced through security vendor telemetry, and three were exclusively surfaced through honeypot data.
The 73 vulnerabilities in this blog affected products from 45 vendors, with Microsoft accounting for approximately 11% of the vulnerabilities. The remaining exposure spanned remote monitoring and managemen
Hackernews
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
blogs_hackernews·2026-09-05
CVE-2026-72898 Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk.
The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach does not affect the security of the company's hardware wallets.
"Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in li
https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjfhttps://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.jsonhttps://www.cve.org/CVERecord?id=CVE-2026-72898https://www.metabase.com/blog/security-updatehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898
2026-08-10
Published
2026-08-11
Added to CISA KEV
Exploited in the wild