Metabase SQL Injection Vulnerability

🚨SEVERITY: CRITICAL — CVSS 10.0Security Advisory

TL;DR 📌

  • Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export…
  • Highest CVSS: 10.0 (Critical).
  • Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-72898.

What it is

CVE-2026-72898 is a SQL injection vulnerability in Metabase. An unauthenticated remote attacker can inject arbitrary SQL into the Metabase application database over the network, with no user interaction required.

Successful exploitation gives the attacker administrator access to the Metabase instance itself. From there, they can change the application’s configuration, retrieve stored credentials for any databases connected to Metabase, read data through those connections, and export it.

The CVSS score is 10.0 (Critical), reflecting the combination of unauthenticated network access, low attack complexity, and full compromise of confidentiality, integrity and availability. The scope change (S:C) in the vector reflects that the impact extends beyond Metabase itself to the connected data sources.

This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-11. It is known to be exploited.

What to do

  • Treat any internet-facing Metabase instance as high priority. Check the advisory at the NVD link for a fixed release, as none is listed yet in the data available here — confirm directly with Metabase before assuming a patch exists.
  • Where a fix is available, apply it immediately given the KEV listing and the unauthenticated network attack path.
  • If patching isn’t yet possible, restrict network access to the Metabase admin/application interface to trusted management networks only — this instance should not be reachable from the open internet.
  • Rotate credentials for any databases connected to Metabase, since stored credentials are a stated impact of this flaw.
  • Review Metabase configuration and audit logs for unexpected admin-level changes or unusual query activity, given this is listed as actively exploited.
  • Confirm your CISA KEV remediation deadline for this CVE and track it through your standard vulnerability management process.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 10.0) across any Metabase kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source