Introduction

In a major development for the cybersecurity community, a critical zero-day vulnerability has been discovered and is being actively exploited in Metabase, the popular open-source business intelligence and data visualization platform. Identified as CVE-2026-72898, this unauthenticated SQL injection vulnerability is currently one of the most severe threats facing organizations that rely on self-hosted data analytics. With a maximum CVSS score of 10.0, the vulnerability allows remote attackers to gain full administrative control over a Metabase instance without any prior authentication.

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-72898 to its Known Exploited Vulnerabilities (KEV) catalog on August 11, 2026, signaling that this is not a theoretical risk but a real-world vector being used by threat actors to compromise sensitive data environments.

What is CVE-2026-72898?

CVE-2026-72898 is a critical SQL injection vulnerability residing in the password-reset flow of the Metabase application. Specifically, the flaw exists within the POST /api/session/reset_password endpoint. The vulnerability stems from a failure to strictly validate the request body, specifically how the application handles the user-id field when compiling database queries.

Technically, the issue arises because Metabase’s query-building stack—which utilizes the HoneySQL library—can be tricked into executing literal SQL commands. If an attacker provides a crafted JSON payload containing a raw SQL map (e.g., {:raw "..."}) instead of a simple integer for the user-id, the application fails to sanitize this input. Consequently, the attacker’s “data” is compiled directly into the underlying SQL query as an executable command, bypassing standard parameterization and security controls.

Impact and Affected Systems

The impact of successful exploitation is nearly total. Because the vulnerability allows for unauthenticated remote code execution at the database query level, an attacker can effectively bypass the entire authentication logic of the application. Once the SQL is injected, the attacker can reset administrative passwords, create new accounts, or extract session tokens from the internal application database.

Beyond the Metabase instance itself, the risk extends to everything the instance is connected to. Organizations typically use Metabase to query vast data warehouses including Snowflake, Amazon Redshift, Google BigQuery, PostgreSQL, and MySQL. An attacker with administrative access can:

• Retrieve encrypted database connection strings and plain-text credentials for all connected data sources.
• Exfiltrate sensitive business data by executing arbitrary queries against those data sources.
• Modify application configurations, such as SMTP and LDAP settings, to maintain long-term persistence.
• Harvest usernames, email addresses, and Slack integration tokens.

This vulnerability affects a wide range of self-hosted Metabase (and Metabase Enterprise) versions:

• v0.58.0 through v0.58.23 (Enterprise 1.58.x)
• v0.59.0 through v0.59.20 (Enterprise 1.59.x)
• v0.60.0 through v0.60.16 (Enterprise 1.60.x)
• v0.61.0 through v0.61.10 (Enterprise 1.61.x)
• v0.62.0 through v0.62.8 (Enterprise 1.62.x)
• v0.63.0 through v0.63.4 (Enterprise 1.63.x)

Note: Metabase Cloud instances have already been patched by the vendor and are not considered at risk for this specific flaw.

Mitigation and Remediation Steps

Given that this vulnerability is under active exploitation, immediate action is required for any organization running a self-hosted instance of Metabase.

1. Immediate Update

The most effective mitigation is to upgrade to the latest patched releases provided by Metabase. Administrators should move to the following versions (or any later release) immediately:

• 0.58.24 / 1.58.24
• 0.59.21 / 1.59.21
• 0.60.17 / 1.60.17
• 0.61.11 / 1.61.11
• 0.62.9 / 1.62.9
• 0.63.5 / 1.63.5

2. Temporary Workaround

If an immediate upgrade is not possible due to change management constraints, organizations should block access to the POST /api/session/reset_password endpoint at the Web Application Firewall (WAF) or reverse proxy level. This will disable the password-reset functionality but prevent exploitation of the vulnerability via that specific vector.

3. Post-Update Hardening

If your instance was exposed to the internet prior to patching, it should be treated as potentially compromised. After upgrading, security teams should perform the following actions:

• Revoke Sessions: Invalidate all active user sessions to ensure any stolen session tokens are no longer usable.
• Rotate Credentials: Change the credentials for all databases and data warehouses connected to Metabase.
• Audit Permissions: Review administrative accounts and API keys for any unauthorized additions or modifications.
• Review Logs: Check application logs for indicators of compromise, such as unexpected 400 errors on the reset_password endpoint followed by 200 status codes on administrative endpoints.

Conclusion

CVE-2026-72898 serves as a stark reminder of the critical nature of unauthenticated endpoints and the persistent threat posed by SQL injection in modern applications. Organizations must prioritize the security of their data analytics platforms, as these often serve as a “master key” to their most valuable data assets. Patching immediately is the only way to ensure your data remains protected against the ongoing wave of exploitation targeting this flaw.