CVE-2026-72898: Metabase SQL Injection Vulnerability

CVE-2026-72898 Overview

CVE-2026-72898 is a SQL injection vulnerability in Metabase, the open-source business intelligence and analytics platform. A remote, unauthenticated attacker can inject arbitrary SQL through the /reset_password database endpoint. Successful exploitation grants administrator access to the affected Metabase instance and the connected databases behind it.

The flaw is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Both the open-source and Enterprise editions of Metabase are affected. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation.

Critical Impact
Unauthenticated attackers can gain full administrator access to Metabase and pivot to any database Metabase connects to, exposing analytics data and downstream systems.

Affected Products

Metabase (open-source edition)
Metabase Enterprise edition
Self-hosted Metabase deployments exposed to untrusted networks

Discovery Timeline

2026-08-10 - CVE-2026-72898 published to NVD
2026-08-12 - Last updated in NVD database
2026-08-13 - EPSS score recorded at 10.4% (95.311 percentile)

Technical Details for CVE-2026-72898

Vulnerability Analysis

The vulnerability resides in the /reset_password database endpoint. Metabase fails to properly sanitize attacker-supplied input before incorporating it into a SQL statement executed against its internal application database. Because the endpoint does not require authentication, any network-reachable attacker can send crafted requests and manipulate query logic.

Exploitation allows the attacker to modify or create administrator credentials, effectively bypassing the entire authentication stack. Once administrator access is obtained, the attacker inherits Metabase's ability to query every connected data source, execute native SQL against them, and in some deployments run arbitrary code through database features. The EPSS probability of 10.4% and CISA KEV listing indicate confirmed exploitation activity.

Root Cause

The root cause is unsanitized user input flowing into a SQL query at the /reset_password endpoint [CWE-89]. Metabase concatenates or interpolates request parameters into SQL rather than using parameterized queries, allowing injection of arbitrary SQL clauses.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the vulnerable /reset_password endpoint containing SQL injection payloads. The injected SQL executes within Metabase's application database context, enabling account manipulation and administrator escalation.

Because realCodeExamples are not available for this CVE, refer to the Metabase GitHub Security Advisory GHSA-vwf4-m7j8-wcjf for authoritative technical details.

Detection Methods for CVE-2026-72898

Indicators of Compromise

HTTP requests to /api/session/reset_password or related /reset_password paths containing SQL syntax such as UNION SELECT, --, ;, or encoded quote characters.
New or unexpected administrator accounts in the Metabase core_user table with is_superuser = true.
Modifications to password hash fields for existing administrator accounts without corresponding user-initiated resets.
Outbound connections from the Metabase host to attacker-controlled infrastructure following suspicious /reset_password traffic.

Detection Strategies

Inspect Metabase and reverse-proxy access logs for POST or GET requests targeting /reset_password from external or unexpected source addresses.
Alert on /reset_password requests containing SQL metacharacters or oversized payloads inconsistent with legitimate token-based reset flows.
Correlate authentication events showing successful administrator logins immediately following anomalous /reset_password requests.

Monitoring Recommendations

Enable verbose HTTP access logging on any load balancer or reverse proxy fronting Metabase and forward logs to a centralized analytics platform.
Monitor the Metabase application database for schema changes, privilege escalations, and unexpected writes to user tables.
Track egress traffic from the Metabase host for signs of data staging or exfiltration following suspicious requests.

How to Mitigate CVE-2026-72898

Immediate Actions Required

Upgrade Metabase to the patched release identified in the Metabase security update and GHSA-vwf4-m7j8-wcjf.
Remove direct internet exposure of Metabase and place instances behind a VPN or authenticated reverse proxy until patching is complete.
Rotate all Metabase administrator credentials and API keys, and rotate credentials for every database Metabase connects to.
Review the core_user table and audit logs for unauthorized administrator accounts or password changes.

Patch Information

Metabase has released fixed versions addressed in the vendor advisory. Consult the GitHub Security Advisory GHSA-vwf4-m7j8-wcjf and the Metabase Security Update blog post for the specific patched versions applicable to both the open-source and Enterprise editions. Because this CVE is listed in the CISA Known Exploited Vulnerabilities catalog, federal agencies are required to remediate within CISA-mandated deadlines.

Workarounds

Restrict network access to Metabase using firewall rules or ingress policies so only trusted management networks can reach the application.
Block requests to /reset_password at the web application firewall (WAF) or reverse proxy for any client outside authorized ranges.
Enforce least-privilege database accounts for Metabase data source connections to limit blast radius if administrator access is obtained.

bash

# Example nginx snippet to restrict /reset_password to a management CIDR
location ~ ^/(api/session/)?reset_password {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://metabase_upstream;
}