CVE-2026-72898: Metabase — Unauthenticated SQL Injection via Password Reset

Background

Metabase is an open-source business intelligence and analytics platform widely deployed in SaaS companies and enterprises for internal analytics and reporting. Many deployments expose the Metabase web UI directly to the internet for team access, and the application is routinely connected to production databases containing customer records, financial data, and business-critical information. The credentials for these connected databases are stored within Metabase itself.

CVE-2026-72898 is a CVSS 10 critical SQL injection vulnerability in Metabase. The flaw sits in an unauthenticated endpoint used for password resets, allowing any remote attacker — without credentials of any kind — to inject arbitrary SQL into Metabase’s application database query. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 11 August 2026. The vulnerability was exploited as a zero-day in real attacks, including confirmed customer data theft campaigns disclosed by affected companies, before the patch was released.

Technical Mechanism

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — SQL Injection) is the root cause classification.

The vulnerable endpoint is the unauthenticated POST /api/session/reset_password. Under normal operation, this accepts a JSON body containing a reset token and new password. The root cause is that Metabase fails to restrict undeclared fields in the JSON body — extra keys are not rejected but instead flow into an application-database lookup query.

The lookup query that verifies the reset token performs a user record retrieval. When an attacker includes an additional field in the JSON body containing a SQL expression instead of a scalar value, that expression is passed to the database query without parameterization. The database receives raw SQL rather than a bound parameter value.

The injection is database-dependent in its payload syntax, as Metabase supports multiple application databases: H2 (the default in many installations), PostgreSQL, MySQL, and MariaDB. In each case, the attacker can craft blind SQL injection payloads to:

1. Manipulate application database records (including user table rows)
2. Elevate a controlled account or token to administrator status
3. Extract stored database connection strings and credentials for all connected data sources

Once administrator access is achieved, the attacker has access to the full Metabase interface, including the ability to run arbitrary SQL queries against every connected database, export query results, modify dashboards, and alter application configuration.

Bishop Fox published a detailed technical analysis demonstrating the injection chain from token lookup to admin-level access. Wiz confirmed active exploitation in the wild, observing the vulnerability used in data theft attacks targeting customer records before the patch was available.

Real-World Exploitation Evidence

CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog on 11 August 2026.

CVE-2026-72898 was exploited as a zero-day. Metabase issued an out-of-cycle security update after detecting attacks in progress. Framework and Tally were among the companies that publicly disclosed incidents traced to this vulnerability, both reporting that attacker access through compromised Metabase instances led to customer data exfiltration.

The attack surface is significant: Metabase is widely deployed in SaaS companies and enterprises for internal analytics, and many deployments expose the web UI directly to the internet for team access. The absence of any authentication requirement means exploitation is straightforward for any attacker with network access to the Metabase port.

RunZero’s network scan telemetry identified thousands of internet-exposed Metabase instances, and exploitation was observed within days of the vulnerability becoming publicly known. No specific threat actor group has been publicly attributed beyond the confirmed zero-day exploitation activity.

Impact Assessment

Successful exploitation gives an unauthenticated remote attacker full administrative access to the Metabase instance. From that position, the attacker gains immediate access to all data Metabase is authorized to query across every connected database — including the ability to run arbitrary SQL and bulk-export results.

The secondary impact is credential exposure: every database connection stored in Metabase includes its credentials, which are accessible to any admin-level user. An attacker who achieves admin access can extract connection strings and passwords for all connected data sources, enabling direct database access that persists beyond Metabase itself and survives any Metabase-level remediation. Organizations in SaaS, fintech, and any sector using Metabase to query customer or financial data face direct data breach risk affecting their end customers.

Affected Versions

Metabase Cloud customers were patched automatically. Self-hosted deployments require manual upgrade.

Remediation Steps

1. Upgrade immediately to a fixed version: v58.24, v59.21, v60.17, v61.11, v62.9, or v63.5 depending on your current branch.

2. If immediate upgrade is not possible:

   • Restrict network access to the Metabase application port (typically 3000) to known IP ranges or a VPN
   • Remove internet exposure entirely until the patch is applied
   • Review Metabase audit logs for any suspicious access to /api/session/reset_password with unexpected JSON fields

3. For organizations that ran a vulnerable version with internet exposure, treat the deployment as potentially compromised: rotate all credentials stored in Metabase database connections, audit query history, and investigate any unexplained user account changes in the application database.

There is no workaround that prevents exploitation while keeping Metabase accessible. Network restriction is the only viable interim control.

Detection Guidance

Log sources: Metabase application logs; web server/load balancer access logs for the Metabase port.

What to look for:

• POST /api/session/reset_password requests from IP addresses that are not recognized password-reset initiators
• Requests to that endpoint containing unusually large or structured JSON bodies
• Admin account creation or privilege changes with no corresponding user-initiated action in the audit log
• New database connections added to Metabase, or changes to existing connection credentials
• Bulk query exports or unusual data access patterns through the Metabase query runner

IOCs: No specific threat actor infrastructure has been publicly attributed, but post-compromise indicators include new admin user accounts with random or auto-generated usernames, and outbound connections from Metabase’s host to attacker infrastructure following data staging.

Timeline

References

• NVD — CVE-2026-72898
• CISA KEV — CVE-2026-72898
• Metabase Security Advisory
• Bishop Fox Technical Analysis
• Wiz — Active Exploitation Confirmation