CVE-2026-72899: Metabase SQL Injection Vulnerability

CVE-2026-72899 Overview

CVE-2026-72899 is a SQL injection vulnerability in Metabase, an open-source business intelligence and analytics platform. An unauthenticated attacker can inject arbitrary SQL through a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. The flaw is tracked under CWE-89 and carries a CVSS 4.0 score of 10.0. Because exploitation requires no authentication and no user interaction, any Metabase instance exposing a public link with a dimension parameter is directly reachable from the internet. Details are published in the GitHub Security Advisory GHSA-r8h2-qpfx-mx59.

Critical Impact
An unauthenticated attacker can execute arbitrary SQL against the Metabase application database through a public share link, leading to full data compromise and potential lateral movement.

Affected Products

Metabase (open-source and Enterprise editions) with publicly shared cards or dashboards
Instances exposing field-filter (dimension) parameters through public links
Refer to GHSA-r8h2-qpfx-mx59 for exact fixed versions

Discovery Timeline

2026-08-10 - CVE-2026-72899 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72899

Vulnerability Analysis

Metabase supports parameterized questions using field filters, also called dimension parameters. These parameters map user-supplied values into SQL fragments that are substituted into the underlying query. When a card or dashboard is made public, Metabase exposes an unauthenticated HTTP endpoint that accepts these parameter values. The vulnerability arises because dimension parameter values are not safely bound to the resulting query, allowing attacker-controlled input to be concatenated into SQL sent to the connected database. An unauthenticated remote attacker can therefore inject SQL that runs with the privileges of the Metabase database user against any datasource bound to the shared question.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Field-filter substitution in the public-question code path builds SQL fragments from parameter input without treating dimension values as data. The trust boundary between an anonymous public visitor and the SQL execution layer is crossed without adequate sanitization or parameterization.

Attack Vector

Exploitation is fully remote and unauthenticated. An attacker locates a public Metabase share URL of the form /public/question/<uuid> or /public/dashboard/<uuid> that exposes at least one dimension parameter. The attacker then supplies a crafted value for that parameter through the public query API. The injected SQL is executed against the datasource behind the shared card, giving the attacker read access to arbitrary tables and, depending on datasource privileges, write or command-execution primitives supported by that database engine.

No verified exploit code is publicly available at the time of writing. See the GitHub Security Advisory and the CISA CSAF document for authoritative technical details.

Detection Methods for CVE-2026-72899

Indicators of Compromise

Requests to /api/public/card/*/query or /api/public/dashboard/*/dashcard/*/card/*/query containing SQL metacharacters, UNION, SELECT, comment sequences, or stacked statements inside parameter values.
Unexpected queries against information_schema, pg_catalog, or vendor system tables originating from the Metabase service account.
New outbound connections from the Metabase application host or its backing database following public-endpoint traffic.
Anomalous spikes in 4xx/5xx responses from public Metabase endpoints as attackers iterate payloads.

Detection Strategies

Inspect Metabase application logs and reverse-proxy access logs for parameter values on public routes that contain SQL syntax.
Deploy web application firewall rules that inspect query strings and JSON bodies on /api/public/* for SQL injection patterns.
Enable and review database audit logs for queries issued by the Metabase datasource user that do not match saved question templates.

Monitoring Recommendations

Alert on any HTTP access to /public/* and /api/public/* routes if public sharing is not an approved use case.
Baseline the SQL fingerprints generated by each public card and alert on deviations that indicate injected clauses.
Track process and network telemetry on the Metabase host for signs of post-exploitation activity such as new shells or credential-file reads.

How to Mitigate CVE-2026-72899

Immediate Actions Required

Upgrade Metabase to a fixed release as listed in GHSA-r8h2-qpfx-mx59.
Disable public sharing globally in Admin settings until all instances are patched, and revoke existing public links.
Rotate credentials for every datasource connected to Metabase and audit those databases for unauthorized queries.
Restrict the Metabase datasource user to read-only, least-privilege access on production databases.

Patch Information

Metabase has published fixes in the versions identified in the GitHub Security Advisory. Administrators should apply the upgrade to all self-hosted deployments. Metabase Cloud tenants are patched by the vendor. Verify the running build after upgrade using the About Metabase panel or the /api/session/properties endpoint.

Workarounds

Turn off the enable-public-sharing site setting until the upgrade is complete.
Remove or unshare any card or dashboard that exposes a field-filter (dimension) parameter.
Place Metabase behind an authenticating reverse proxy or VPN so that /public/* routes are not reachable from the internet.
Add WAF signatures that block SQL metacharacters in parameter values on public endpoints.

bash

# Disable public sharing via the Metabase API (admin session required)
curl -X PUT https://metabase.example.com/api/setting/enable-public-sharing \
  -H "Content-Type: application/json" \
  -H "X-Metabase-Session: <admin-session-token>" \
  -d '{"value": false}'