SQL injection in Metabase via publicly shared field-filter parameter (CVE-2026-72899)

An unauthenticated attacker can inject arbitrary SQL into the Metabase application database through a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. Exploiting only the public link UUID, an attacker could alter application configuration, steal stored database credentials, read any accessible data, and export data. Public sharing is enabled by default, making any published link with a field-filter parameter a potential attack vector. Affected versions: - >= x.58.0, < x.58.24 - >= x.59.0, < x.59.21 - >= x.60.0, < x.60.17 - >= x.61.0, < x.61.11 - >= x.62.0, < x.62.9 - >= x.63.0, < x.63.5 We recommend updating to: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5. CVSS 10.0 · our assessment: act_now Reference: https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59 Details: https://vuln.today/cve/CVE-2026-72899