CVE-2026-72898 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-10

Added to CISA KEV: 2026-08-11 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review web/application logs for requests to '/reset_password', inspect for forged admin sessions/newly created admin accounts, audit connected database access, and verify system and data integrity.
Immediately patch to a fixed version: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 (or later) as applicable to your branch.
If immediate patching is not possible, restrict network access to the Metabase interface (especially '/reset_password') via firewall/WAF rules, remove direct internet exposure, and place behind VPN/zero-trust access. Rotate all database credentials configured in Metabase and any admin secrets, as they may have been exfiltrated.
Monitoring: deploy WAF/IDS signatures for SQLi against the reset_password endpoint, alert on anomalous admin session creation, and continuously scan external attack surface for exposed instances.
Patch priority: EMERGENCY / P1 - remediate within 24-48 hours given KEV listing, CVSS 10.0, public PoC, and active mass exploitation.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-72898 is a critical SQL injection vulnerability affecting the Metabase business intelligence platform. It allows a remote, unauthenticated attacker to inject arbitrary SQL queries through the `/reset_password` endpoint ^[4]^[6]. This flaw is highly significant because it enables an attacker to bypass all authentication mechanisms to gain full administrator access to the Metabase instance, potentially leading to unauthorized data exfiltration or deeper system compromise ^[1]^[3].

Exploitation

Active Exploitation: The vulnerability is currently under active exploitation in the wild, and the Cybersecurity and Infrastructure Security Agency (CISA) has added it to their Known Exploited Vulnerabilities (KEV) catalog ^[2].
Threat Actors: There are reports of mass exploitation campaigns targeting thousands of self-hosted instances ^[3].
Proof-of-Concept: Publicly available proof-of-concept (PoC) exploit code exists, which demonstrates how to inject a forged administrator session into the database to gain full control without valid credentials ^[1].
Prerequisites: The attack is remote, does not require any authentication or user interaction, and only requires network access to the vulnerable endpoint ^[5].

Affected Products & Patches

Affected Versions: All self-hosted Metabase versions prior to the release of the official security patch are considered vulnerable.
Patch Availability: Users are urged to update to the latest version of Metabase immediately, as developers have issued patches to remediate the SQL injection vulnerability ^[2].
Mitigation: In environments where immediate patching is not feasible, administrators should restrict network access to the `/reset_password` endpoint or the entire Metabase interface using firewall rules or WAF policies to prevent external access.

Impact

Access and Capability: Successful exploitation provides the attacker with full administrative privileges, allowing them to perform any action a legitimate admin could, including querying the underlying databases connected to Metabase, stealing stored database credentials, and potentially executing further unauthorized operations on the host server ^[1]^[2].
Business Risk: For internet-facing deployments, this vulnerability represents an extreme business risk, as the platform often serves as a centralized hub for sensitive business data. Unauthorized access can lead to significant data breaches, loss of intellectual property, and severe regulatory compliance violations.

Sources

4minx/CVE-2026-72898: CVE-2026-72898 PoC - GitHub
Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the core_session table, then uses it to validate a full administrator session without any credentials. Note: This PoC is for authorized…
CVE-2026-72898: Metabase SQL Injection Under Active Exploitation ...
CISA has added CVE-2026-72898 to the KEV catalog: an unauthenticated SQL injection in Metabase granting attackers full admin access and database credential theft. Patch immediately.
Cyber Intel Brief: CVE-2026-72898 in Metabase
Unauthenticated SQL injection in Metabase (CVE-2026-72898) lets attackers gain admin database access without credentials.
CVE-2026-72898 - Unauthenticated SQL Injection
CVE-2026-72898 is a maximum-severity (CVSS 10.0) unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to ...
NVD-CVE-2026-72898 - National Vulnerability Database
CVE-2026-72898 Detail Description Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database ... CVE-2026-72898 Detail Description Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint…

🔴 CVE-2026-72898