CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog on 2026-08-11, confirming active exploitation of an unauthenticated SQL injection flaw in Metabase that hands attackers administrator access to the instance.
What Is It
CVE-2026-72898 is a SQL injection vulnerability (CWE-89) in Metabase. Per NVD, a remote, unauthenticated attacker can inject arbitrary SQL through the /reset_password HTTP API endpoint, user input from that request reaches a backend SQL query without proper sanitization, and gain administrator access to the affected Metabase instance.
It carries a CVSS 3.1 base score of 10.0 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with scope change. CVSS 4.0 scoring also lands at 10.0 critical. CISA's SSVC assessment records exploitation as active, automatable yes, and technical impact total.
Why It Matters
CISA KEV confirms this is being exploited in the wild. The injected SQL executes against Metabase's own internal application database, the store holding user records, permissions, and saved connection settings, which is what turns a single unauthenticated request into administrator control. From there, per CISA, an attacker can change the application configuration, steal stored credentials for connected databases, read any data reachable through those connections, and export data.
That makes Metabase a pivot point rather than an endpoint: the value sitting behind a BI tool is every database it is wired into. Known ransomware campaign use is listed as Unknown.
What's Vulnerable
Vendor: Metabase. Product: Metabase. Affected version ranges and their fixed releases, per NVD:
| Affected | Fixed in |
|---|---|
| x.58.0 – < x.58.24 | x.58.24 |
| x.59.0 – < x.59.21 | x.59.21 |
| x.60.0 – < x.60.17 | x.60.17 |
| x.61.0 – < x.61.11 | x.61.11 |
| x.62.0 – < x.62.9 | x.62.9 |
| x.63.0 – < x.63.5 | x.63.5 |
Patch Status
Fixed builds are available across all six affected branches (listed above). CISA's required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines.
Because exploitation requires no authentication and is confirmed in the wild, patching alone does not settle the question of prior compromise; instances exposed before the fix warrant a review of admin accounts and a rotation of credentials stored for connected data sources.
The KEV due date is 2026-08-14: three days after listing.