CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection

Metabase Pre-Authentication SQL Injection Leading to Admin Takeover

Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the core_session table, then uses it to validate a full administrator session without any credentials.

Note: This PoC is for authorized security testing and research only. CVE-2026-72898 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is being actively exploited in the wild. You are responsible for complying with all applicable laws and obtaining written authorization before testing any system.

Vulnerability Information

• CVE: CVE-2026-72898
• Type: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CVSS 4.0: 10.0 (Critical)
• Authentication: Unauthenticated (pre-auth, remote, low attack complexity)
• CISA KEV: Added 2026-08-11 (active exploitation)
• Affected (Metabase):
  • x.58.0 to < x.58.24
  • x.59.0 to < x.59.21
  • x.60.0 to < x.60.17
  • x.61.0 to < x.61.11
  • x.62.0 to < x.62.9
  • x.63.0 to < x.63.5
• Fixed in: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5

Requirements

• Python 3.8+ with the requests library
• Target: an affected, internet-exposed Metabase instance

Install dependencies:

pip install requests

Usage

Single Target

python cve-2026-72898_poc.py -t http://192.168.1.1:3000

Mass Scan

python cve-2026-72898_poc.py -T targets.txt

Options

Example Output

 CVE-2026-72898 | Metabase SQLi PoC
----------------------------------------

Target: http://192.168.1.1:3000
 [1] GET http://192.168.1.1:3000/ -> 200
 [2] POST /api/session/reset_password -> 400
      (expected: Invalid reset token, SQLi executed)
 [3] GET /api/user/current -> 200
[+] VULNERABLE
    session id : 242x6a6cx-5388-aaf8-bl5c-afi46ic02198
    key_hashed : 0f6005cbexf08948c08dd9272b439xfecwabxb4ntedd83bagb6337bx849b6xyi6
    admin email: [email protected]

A 400 on step 2 with Invalid reset token is expected — it means the SQLi payload executed and the response was short-circuited. Step 3 returning 200 on /api/user/current confirms the forged session is valid.

Result statuses: vulnerable | not_vulnerable | patched | root_not_200 | unknown | error

Using the Forged Session

Metabase reads its session from the `metabase.SESSION` cookie, so you can log in to the web UI as the forged admin by adding that cookie:

**Google Chrome / Edge / Chromium**

1. Run the PoC and copy the printed `session id`
2. Open `http://TARGET/` and press `F12` (DevTools)
3. Go to **Application** (in Edge: **Application**; in Chrome: **Application**) → **Storage** → **Cookies** → select the target host
4. Click the **+** (Add cookie) button and fill in:
   - **Name**: `metabase.SESSION`
   - **Value**: `<SESSION_ID>` (the value printed by the PoC)
   - **Domain**: the target host/IP (e.g. `192.168.1.1` or `.example.com`)
   - **Path**: `/`
   - Set an expiration far in the future (or click "Session")
5. Click **Save**, then refresh the page
6. You are now authenticated as the superuser &mdash; the admin gear icon will be visible

**Firefox**

1. Run the PoC and copy the printed `session id`
2. Press `F12` &rarr; **Storage** tab &rarr; **Cookies** &rarr; select the target host
3. Right-click &rarr; **Add/Edit Cookie** and add:
   - **Name**: `metabase.SESSION`
   - **Value**: `<SESSION_ID>`
   - **Path**: `/`
   - **HttpOnly**: unchecked (JS sets it)
   - **Secure**: unchecked for plain HTTP
4. Save and refresh the page

**Alternative: cookie editor extension**

Use any cookie-editing extension (e.g. Cookie-Editor) to add the `metabase.SESSION` cookie with the forged value on the target domain, then refresh.

**From the browser console**

```js
fetch('/api/user/current', { headers: { 'X-Metabase-Session': '<SESSION_ID>' } })
  .then(r => r.json()).then(console.log)

Mitigations

• Upgrade to a patched version (x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 or newer)
• If you cannot upgrade immediately, block /api/session/reset_password at the network/WAF layer
• After upgrading: revoke all active sessions, rotate credentials for connected databases, review admin accounts and API keys for unexpected changes, and audit Metabase activity/query history

☕ Support

If this project helped you, consider supporting its development:

USDT (TRC-20)

TDCPYioWbZW4iyMCuHhJeFsUZJ88YqZWc1

ETH (ERC-20)

0xf6eA555f95ed5b356fF7a90E6461EbBF6ce105cE

References

• Metabase Security Advisory (GHSA-vwf4-m7j8-wcjf)
• Metabase Security Update
• CVE.org Record – CVE-2026-72898
• NVD – CVE-2026-72898
• CISA Known Exploited Vulnerabilities Catalog
• Horizon3.ai – Metabase SQL Injection
• The Hacker News – Metabase Zero-Day Exploited in Wild
• Nuclei Template – Metabase Unauthenticated SQL Injection