Metabase Pre-Authentication SQL Injection Vulnerability

CVE-2026-72898 is a critical unauthenticated SQL injection vulnerability in Metabase, a widely used open-source business intelligence and data analytics platform. Successful exploitation can give an attacker administrator access to the affected Metabase instance, allowing them to change application configuration, steal stored credentials for connected databases, read data accessible through those connections, and export data. The vulnerability is rated CVSS 10.0 (Critical), the highest possible severity rating. Metabase has confirmed that attackers are actively exploiting the vulnerability against real-world environments.

Technical Details

CVE-2026-72898 allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database. No authentication or user interaction is required, and the vulnerability can be exploited remotely over the network with low attack complexity.

Successful exploitation can provide administrator access to the affected Metabase instance. From there, an attacker could:

• Change Metabase application configuration
• Steal stored credentials for connected databases
• Read data accessible through those database connections
• Export data

The vulnerability is rated CVSS 10.0 (Critical), with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Metabase has confirmed active exploitation.

Stop Guessing, Start Proving

NodeZero® Proactive Security Platform — Rapid Response

A NodeZero Rapid Response test has been developed to safely validate whether this SQL injection vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.

• Run the Rapid Response test: Launch from the NodeZero platform to determine whether exploitation is possible
• Patch immediately: Upgrade to the appropriate fixed Metabase release for your deployment. If immediate patching is not possible, temporarily block the /api/session/reset_password endpoint
• Re-run the test: Confirm the vulnerability is no longer exploitable after remediation

Affected versions & patch

Affected

Metabase identifies the following affected version ranges:

• >= x.58.0, < x.58.23
• >= x.59.0, < x.59.20
• >= x.60.0, < x.60.16
• >= x.61.0, < x.61.10
• >= x.62.0, < x.62.8
• >= x.63.0, < x.63.3

Fixed

Metabase lists the following patched versions:

• x.58.24
• x.59.21
• x.60.17
• x.61.11
• x.62.9
• x.63.5

Organizations should upgrade to the patch corresponding to their Metabase major version as soon as possible.

Mitigations

If immediate upgrading is not possible, Metabase recommends temporarily blocking the /api/session/reset_password endpoint.

If this endpoint was publicly accessible, Metabase recommends taking additional steps after upgrading:

• Revoke all active user sessions
• Review API keys and delete any unrecognized keys
• Review administrator accounts for unexpected changes
• Rotate credentials for connected databases
• Review data warehouse logs for signs of unauthorized access
• Review Metabase activity and query history for unexpected or unauthorized activity

Timeline

• August 3, 2026: Metabase discovered attacks against Metabase Cloud involving a previously unknown vulnerability and began investigating and containing the activity.
• August 6, 2026: Metabase published its security advisory for CVE-2026-72898, confirming the vulnerability as a critical unauthenticated SQL injection with active exploitation.
• August 6, 2026: Metabase made patched releases available across the affected x.58 through x.63 release branches.
• August 12, 2026: Horizon3.ai released a NodeZero Rapid Response test for CVE-2026-72898.

References

• Metabase Security Advisory
• Metabase Security Update
• CVE.org Record – CVE-2026-72898
• The Hacker News – Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication