🔴 CVE-2026-72898 - Unauthenticated SQL Injection

Metabase — Unauthenticated SQL Injection → Full Administrator Takeover

📌 Overview

CVE-2026-72898 is a maximum-severity (CVSS 10.0) unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the application database via the password-reset endpoint.

Successful exploitation grants full administrator access to the Metabase instance. From there, an attacker can:

• Modify application configuration
• Steal stored credentials for connected databases
• Read any data accessible through those connections
• Export sensitive data at will

This vulnerability was exploited in the wild as a zero-day against Metabase Cloud and multiple self-hosted customers.

⚡ Key Details

🎯 Affected Endpoint

POST /api/session/reset_password

An unauthenticated attacker can send a crafted request to this endpoint that results in arbitrary SQL execution against the Metabase application database.

📦 Affected Versions

Versions below 58 are not affected.

🛠️ Remediation

1. Upgrade Immediately (Recommended)

Upgrade to the fixed version corresponding to your major release:

2. Temporary Workaround

If you cannot upgrade immediately, block access to the vulnerable endpoint:

/api/session/reset_password

🔍 Detection & Indicators of Compromise

Look for this characteristic attack pattern in your application or ingress logs:

POST /api/session/reset_password   →  400
GET  /api/user/current             →  200

If this sequence appears, your instance is likely compromised.

Post-Upgrade Actions (Highly Recommended)

After upgrading, perform the following:

1. Invalidate all sessions

   root@kitploit:~

   TRUNCATE TABLE core_session;
   

2. Review and delete any unrecognized API keys

3. Audit administrator accounts for unexpected changes

4. Rotate credentials for all connected databases

5. Review data warehouse logs for unauthorized access

6. Examine Metabase activity & query history for anomalies

📚 Official References

• Metabase Security Advisory (GHSA-vwf4-m7j8-wcjf)
• Metabase Official Blog Post
• CVE Record
• CISA Known Exploited Vulnerabilities Catalog

⚠️ Disclaimer

This document is provided for defensive and informational purposes only.
Always verify information against official vendor advisories.

Upgrade now. Every unpatched instance remains a high-value target.