CVE-2026-72898: Critical SQL injection in Metabase unauthenticated

Unauthenticated SQL injection in Metabase via '/reset_password' granting administrator access. CVSS 10.

CVE-2026-72898 exposes a critical SQL injection vulnerability in Metabase. A remote attacker, without authentication, can inject arbitrary SQL commands via the '/reset_password' endpoint to gain administrator access to the connected Metabase instance. This complete authentication bypass directly impacts business intelligence and analytics systems.

The CVSS score is 10.0 (maximum), with critical severity. Unverified social signals report inclusion in CISA KEV and active exploitation with public PoC, indicating a real and immediate threat level.

Highest priority: update Metabase to patched versions immediately. Promptly review access logs and database for anomalous activity on '/reset_password' from the vulnerability disclosure date onward. Implement WAF or network filters to restrict access to this endpoint until patching. Monitor your Metabase instances for exploitation attempts.

At a glance

What: Metabase allows unauthenticated SQL injection via the '/reset_password' endpoint, enabling a remote attacker to gain administrator access to the connected instance.
Severity: CVSS 10.0 (critical) - maximum score, critical impact on confidentiality, integrity, and availability.
Affected versions: Not reported in official NVD description.
Fix: Patched versions available (specifics not reported by NVD; consult official Metabase advisory).
Status: Unverified social signals report inclusion in CISA KEV, active exploitation, and public PoC availability.
Action: Update Metabase immediately to patched versions. Review access logs for anomalous activity on '/reset_password'. Restrict endpoint access with WAF/network filters until patching.

Sources: NVD, CVE-2026-72898

← All articles