Metabase SQL Injection Vulnerability

🚨SEVERITY: CRITICAL — CVSS 10.0Security Advisory

TL;DR 📌

  • Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the ‘/reset_password’ database endpoint and gain administrator access to the connected Metabase instance.
  • Highest CVSS: 10.0 (Critical).
  • Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
  • Fixed in 0.58.24, 0.59.21, 0.60.17, 0.61.11 — upgrade to this release or later.
  • CVEs: CVE-2026-72898.

What it is

CVE-2026-72898 is a SQL injection vulnerability in Metabase, reachable through the /reset_password database endpoint. An attacker needs no credentials and no prior access — this is a network-facing, unauthenticated flaw against Metabase’s own management interface.

By injecting SQL through the reset-password flow, an attacker can gain administrator access to the connected Metabase instance. Given that Metabase typically sits in front of one or more backend databases to serve dashboards and queries, admin-level compromise of the Metabase application itself is the direct consequence — the CVSS vector confirms full loss of confidentiality, integrity, and availability, with a scope change (S:C) reflecting that the impact extends beyond the vulnerable component.

The CVSS score is 10.0 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-exploitable, low attack complexity, no privileges or user interaction required. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-11.

What to do

  • Patch immediately. Fixed versions are listed by NVD as: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5, and the corresponding 1.x line — 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, 1.63.5. Match the fix to whichever major/minor branch you currently run.
  • If patching cannot happen immediately, restrict network access to the Metabase instance — particularly to the /reset_password endpoint — to trusted management networks only, since the flaw requires no authentication and is exploitable over the network.
  • Because this is in CISA KEV, treat it as a mandatory remediation item under any KEV-driven patching policy your organisation follows.
  • After patching, review Metabase admin accounts and audit logs for unexpected administrator creation or password resets that predate the fix, since successful exploitation grants admin access directly.
  • Confirm the specific fixed build for your deployment against the advisory at the NVD entry for CVE-2026-72898, as this brief only lists the versions NVD has published.

For leadership 🧭

Executive summary. A maximum-severity, unauthenticated flaw in Metabase’s reset-password endpoint lets any network attacker gain full administrator access to the instance, and it is already listed as a known exploited vulnerability. This needs same-day attention: patch or restrict access to the endpoint now, not at the next scheduled window.

Why it matters:

  • The flaw sits in the ‘/reset_password’ database endpoint, which by design accepts unauthenticated requests, so no stolen credentials or prior foothold are needed.
  • Successful exploitation hands the attacker administrator rights over the Metabase application itself, which typically sits in front of one or more backend databases used for dashboards and reporting.
  • CVSS 10.0 with S:C reflects that impact isn’t confined to Metabase — full confidentiality, integrity and availability loss is possible, extending to whatever data Metabase queries.
  • It is already in CISA’s Known Exploited Vulnerabilities catalogue, which triggers mandatory remediation timelines under most KEV-driven patching policies.

Now / Next / Later:

  • Now: Identify every Metabase instance reachable from untrusted networks and restrict access to it — especially the ‘/reset_password’ path — to trusted management networks until patched.
  • Next: Upgrade to the fixed version matching your current branch (e.g. 0.58.24 through 0.63.5, or the equivalent 1.x releases 1.58.24 through 1.63.5), confirming the exact build against the NVD entry for CVE-2026-72898.
  • Later: After patching, audit Metabase admin accounts and logs for administrator creation or password resets predating the fix, and add KEV-listed vulnerabilities in dashboard/BI tooling to your mandatory patch SLA.

Source