0xblackash/cve-2026-72898CVE-2026-72898
Unauthenticated SQL Injection
CVE-2026-72898 is a maximum-severity (CVSS 10.0) unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the application database via the password-reset endpoint.
Successful exploitation grants full administrator access to the Metabase instance. From there, an attacker can:
This vulnerability was exploited in the wild as a zero-day against Metabase Cloud and multiple self-hosted customers.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-72898 |
| GHSA | GHSA-vwf4-m7j8-wcjf |
| Severity | Critical |
| CVSS v3.1 | 10.0 — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVSS v4.0 | 10.0 |
| CWE | CWE-89 — Improper Neutralization of Special Elements used in an SQL Command |
| Attack Vector | Network |
| Authentication | None required |
| User Interaction | None |
| Exploitation Status | Actively exploited in the wild (Zero-day) |
| CISA KEV | Listed |
POST /api/session/reset_password
An unauthenticated attacker can send a crafted request to this endpoint that results in arbitrary SQL execution against the Metabase application database.
| Branch | Affected Versions | Fixed Version |
|---|---|---|
| x.58 | ≥ x.58.0 and < x.58.24 | x.58.24 |
| x.59 | ≥ x.59.0 and < x.59.21 | x.59.21 |
| x.60 | ≥ x.60.0 and < x.60.17 | x.60.17 |
| x.61 | ≥ x.61.0 and < x.61.11 | x.61.11 |
| x.62 | ≥ x.62.0 and < x.62.9 | x.62.9 |
| x.63 | ≥ x.63.0 and < x.63.5 | x.63.5 |
Versions below 58 are not affected.
Upgrade to the fixed version corresponding to your major release:
If you cannot upgrade immediately, block access to the vulnerable endpoint:
/api/session/reset_password
Look for this characteristic attack pattern in your application or ingress logs:
POST /api/session/reset_password → 400
GET /api/user/current → 200
If this sequence appears, your instance is likely compromised.
After upgrading, perform the following:
Invalidate all sessions
TRUNCATE TABLE core_session;
Review and delete any unrecognized API keys
Audit administrator accounts for unexpected changes
Rotate credentials for all connected databases
Review data warehouse logs for unauthorized access
Examine Metabase activity & query history for anomalies
This document is provided for defensive and informational purposes only.
Always verify information against official vendor advisories.
Upgrade now. Every unpatched instance remains a high-value target.