CVE-2026-72898: Metabase Setup Endpoint SQLi Patch

This repository contains the hotfix for CVE-2026-72898, an unauthenticated SQL Injection vulnerability in the setup endpoint of self-hosted Metabase instances.

Left unpatched, attackers can bypass the setup token validation, execute arbitrary database commands, and extract data warehouse credentials.

The Root Cause

The validate-setup-token function previously accepted unvalidated user input and concatenated it directly into a raw JDBC string. This allowed an attacker to break out of the SQL string and append malicious commands.

Patch Architecture

This patch fundamentally shifts the validation mechanism to neutralize SQL injection vectors:

1. ORM Integration: Migrates database queries from raw strings to Toucan 2 (t2), Metabase's native Object-Relational Mapper.
2. Input Isolation: The system no longer passes user input into the database to verify the token. Instead, it queries the database for the expected token using strict parameterization.
3. In-Memory Validation: Uses crypto.equality/eq? to compare the tokens in application memory (Clojure) rather than in the database.
4. Timing Attack Resistance: The crypto.equality/eq? function executes in constant time, preventing attackers from brute-forcing the token via timing discrepancies.

Implementation Details

Replaces the vulnerable raw jdbc/query logic in metabase.api.setup.

License

Metabase is licensed under the AGPL. This patch is provided under the same terms.