CVE-2026-72898 Metabase SQL Injection
Remote unauthenticated attackers can inject SQL via the password reset endpoint to gain administrator access to Metabase instances.
- Exploited in the wild
- Since 11 Aug 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72898?
CVE-2026-72898 is a critical SQL injection vulnerability in Metabase, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Weakness: CWE-89
Which versions are affected by CVE-2026-72898?
It affects 1 product.
Products include Metabase Metabase.
How do I fix CVE-2026-72898?
No fix has been published for CVE-2026-72898 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Aug 2026.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-72898 being exploited?
Yes. Attackers have exploited CVE-2026-72898 in the wild since at least 11 Aug 2026.
Public exploit code: 1 Nuclei template and 12 proofs of concept on GitHub.
Other vulnerabilities in Metabase
- CVE-2021-41277 Metabase GeoJSON API Local File Inclusion
- CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2023-37470 Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
- CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results
- CVE-2023-38646 Command injection in n/a