Metabase SQL injection grants admin access (CVE-2026-72898)

Actively exploited in the wild - CVE-2026-72898 is a critical SQL injection vulnerability in Metabase that lets remote, unauthenticated attackers seize administrator control of the connected instance. Patched in recent releases; update immediately to prevent takeover.

Overview

CVE-2026-72898 is a pre-authentication SQL injection flaw in the /reset_password database endpoint of Metabase. The vulnerability carries a maximum CVSS score of 10.0, indicating it is trivially exploitable over the network with no user interaction or special privileges required.

At its core, the flaw allows an attacker to manipulate SQL queries sent to the backend database through the password reset flow. This injection point does not require valid credentials, meaning any remote attacker who can reach the Metabase web interface can exploit it.

The consequence of successful exploitation is severe: the attacker gains full administrator access to the Metabase instance. This includes access to all dashboards, queries, and datasets stored within the application, as well as the ability to modify configurations and potentially pivot to the underlying database server. In a Metabase deployment connected to sensitive production databases, this effectively hands the attacker the keys to that data.

CISA has confirmed this vulnerability is being actively exploited in the wild and has added it to the Known Exploited Vulnerabilities (KEV) catalog. While the EPSS score indicates a relatively low probability of exploitation in the next 30 days (0.7%), the confirmed active exploitation and the trivial attack requirements make immediate patching a priority.

Affected Versions and Remediation

Metabase has released patched versions that address CVE-2026-72898. Administrators should upgrade to the latest stable release of both Metabase Open Source and Metabase Enterprise editions as soon as possible.

The vendor advisory includes the specific patched version numbers, and organizations should review it for exact version compatibility with their deployment. Given the confirmed active exploitation, any delay in patching leaves the instance exposed to takeover.

Mitigation Steps

For environments where an immediate upgrade is not possible, apply the following mitigations:

1. Restrict network access to the Metabase web interface using firewall rules or security groups, allowing connections only from trusted IP ranges.
2. Place Metabase behind a reverse proxy with Web Application Firewall (WAF) rules capable of detecting and blocking SQL injection attempts.
3. Monitor authentication and database query logs for anomalous password reset activity or unexpected SQL statements.

Security Insight

This vulnerability underscores a recurring pattern in modern analytics and BI platforms: complex database-backed features, such as password reset flows, become high-value attack surfaces when they touch the underlying query engine. The fact that a reset endpoint, designed for user convenience, can be weaponized into a full administrative takeover illustrates how security testing must extend beyond primary application logic to every peripheral feature that interacts with the database layer. Organizations should treat any tool with direct database connectivity as a critical component in their threat model and apply the same patching urgency as they would to core infrastructure. For the latest updates on this and related incidents, visit our security news and review breach reports for related attack activity.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs