SQL injection via unauthenticated endpoint in Metabase (CVE-2026-72898)

Metabase contains a SQL injection vulnerability in the `/api/session/reset_password` endpoint that can be exploited by a remote, unauthenticated attacker. Successful exploitation allows the attacker to inject arbitrary SQL into the Metabase application database and gain administrator access to the instance, enabling configuration changes, credential theft, and unauthorized data access. Metabase has confirmed active exploitation of this vulnerability in the wild. Affected versions: - >= x.58.0, < x.58.23 - >= x.59.0, < x.59.20 - >= x.60.0, < x.60.16 - >= x.61.0, < x.61.10 - >= x.62.0, < x.62.8 - >= x.63.0, < x.63.3 We recommend updating to: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5. CVSS 10.0 · our assessment: act_now Reference: https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf Details: https://vuln.today/cve/CVE-2026-72898