Metabase CVE-2026-72898: CVSS 10 SQLi Under Active Attack

A CVSS 10.0 SQL injection vulnerability in Metabase, tracked as CVE-2026-72898, is under active exploitation and now carries a three-day remediation deadline from CISA. The flaw lets an unauthenticated remote attacker inject arbitrary SQL into the Metabase application database, escalate to administrator access, steal stored credentials for connected databases, and exfiltrate any data reachable through those connections. On August 11, 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog with a due date of August 14, 2026 — one of the shortest windows the agency has ever enforced for a software flaw. Teams running self-hosted Metabase in cloud environments must patch or block the vulnerable endpoint immediately, because every major version from v58 through v63 is affected.

How the Attack Works

The vulnerability lives in the /api/session/reset_password endpoint, which is reachable without authentication on any internet-facing Metabase instance. An attacker sends crafted SQL through this endpoint into the application database — the internal store that holds Metabase’s own configuration, user accounts, API keys, and encrypted connection strings for downstream databases. Because the injection target is the application database rather than a connected analytics database, the attacker can manipulate Metabase itself: creating or modifying administrator accounts, changing application settings, and extracting the encrypted credentials that Metabase stores for each connected data source.

Metabase has assigned the flaw a CVSS 3.1 base score of 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning it is remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, changes scope, and delivers full impact across confidentiality, integrity, and availability. Metabase confirmed active exploitation of the vulnerability in its advisory, and the scope change indicates that a compromise of the Metabase application can cascade into every database it connects to — a particularly dangerous blast radius for analytics platforms that typically sit in front of data warehouses, lakes, and production databases.

Affected and Patched Versions

Every supported Metabase major version from v58 onward is affected. Self-hosted instances in cloud VMs, Kubernetes clusters, or container platforms are the primary exposure surface. The following table maps each major version to its last vulnerable release and the first patched release:

Metabase Cloud-hosted instances were patched by the vendor before public disclosure and do not require customer action. Self-hosted deployments should identify their version in the admin panel and apply the corresponding patch. Instances below v58.0 are end-of-life and have no patch available; the only option is to isolate the instance, rotate all credentials, and migrate to a supported version. For teams that cannot immediately upgrade, blocking the /api/session/reset_password endpoint at the reverse proxy, load balancer, or WAF is the only documented temporary workaround.

Remediation: Patch and Block

If the endpoint was publicly accessible, patching alone is not sufficient — the vulnerability grants full application-database control, which means an attacker may have already established persistence through rogue admin accounts or stolen API keys. Follow this ordered procedure:

1. Block the endpoint. Immediately deny access to /api/session/reset_password at the edge before applying the patch, to stop active exploitation during the upgrade window.
2. Upgrade Metabase. Pull the patched image or release for your major version and deploy. Verify the version number in the admin panel after the upgrade completes.
3. Revoke all sessions. Access the application database and delete every row in the core_session table to force all users to re-authenticate.
4. Audit API keys. Delete any API key that you cannot attribute to a known service or integration.
5. Review admin accounts. Check for unexpected administrator accounts or privilege changes made after the exposure window began.
6. Rotate connected-database credentials. Rotate the credentials for every database that Metabase connects to, because the application database stores their encrypted connection strings.
7. Review downstream logs. Examine data warehouse and production database logs for unauthorized queries or data exports during the exposure window.

Teams running Metabase behind a shared load balancer or ingress controller in AWS, GCP, or Azure should add a path-based rule to block the endpoint if they cannot upgrade within hours. Cloud security teams can use existing cloud security layering models to confirm that WAF, network ACL, and IAM controls are aligned before exposing the upgraded instance again.

Post-Upgrade Forensics Checklist

Because CVE-2026-72898 allows attackers to pivot from the Metabase application database into every connected data source, the forensic scope extends well beyond the Metabase host itself. Use the following checklist to verify no persistence remains:

• Application database: Query the core_session table for sessions originating from unexpected IPs during the exposure window.
• API keys: Compare the current key list against a known-good inventory; investigate any orphaned keys.
• Admin accounts: Diff the current admin list against the pre-exposure baseline; remove any unexplained accounts.
• Connection strings: Confirm that all downstream database credentials have been rotated and the old credentials are revoked, not just superseded.
• Query history: Review Metabase’s query history and the connected data warehouses’ audit logs for large exports or SELECT-all patterns consistent with data theft.
• Configuration: Verify that no application settings — such as SMTP, SSO, or outbound integration endpoints — were modified to redirect data.

For broader context on how analytics and content tools fit into cloud attack chains, the recent Joomla CVSS 10 RCE analysis covers a parallel pattern of platform compromise cascading into cloud infrastructure. The lesson is the same: any application that holds credentials for downstream databases is a high-value pivot point, and a single unauthenticated endpoint can collapse the entire perimeter.

Sources

• CISA — Adds Three Known Exploited Vulnerabilities to Catalog (August 11, 2026)
• CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-72898 entry)
• Metabase — GitHub Security Advisory GHSA-vwf4-m7j8-wcjf (CVE-2026-72898)