Skip to main content

Metabase CVE-2026-72898

| EUVDEUVD-2026-55690 CRITICAL
SQL Injection (CWE-89)
2026-08-10 cisa-cg
SQLi Metabase
10.0
CVSS 4.0 · Vendor: cisa-cg
Share

Severity by source

Vendor (cisa-cg) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Remote unauthenticated SQLi with no user interaction (AV:N/AC:L/PR:N/UI:N); admin takeover compromising connected databases justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Added to CISA KEV
Aug 11, 2026 - 19:49 CISA
Analysis Generated
Aug 10, 2026 - 18:35 vuln.today
CVE Published
Aug 10, 2026 - 17:55 cve.org
CRITICAL 10.0

DescriptionCVE.org

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

AnalysisAI

SQL injection in Metabase's '/reset_password' database endpoint lets a remote, unauthenticated attacker inject arbitrary SQL and escalate to administrator on the connected Metabase instance. Rated CVSS 4.0 10.0 (CWE-89), it is network-exploitable with no authentication or user interaction, and full compromise of the application and its subsequent systems is achievable. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach internet-exposed Metabase interface
Delivery
Send crafted request to /reset_password
Exploit
Inject arbitrary SQL (CWE-89)
Execution
Manipulate auth data for admin access
Persist
Log in as administrator
Impact
Access connected databases and stored credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation against default configurations of Metabase, provided the attacker can reach the Metabase HTTP interface and specifically the '/reset_password' database endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine top-tier priority, not a high-CVSS-but-low-real-risk case: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated attack with no user interaction, and the vulnerable-system and subsequent-system impacts are all High (VC/VI/VA and SC/SI/SA = H), yielding the maximal 10.0 score and matching the description's outcome of full administrator takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the Metabase login/password-reset surface over the network sends a crafted HTTP request to the '/reset_password' endpoint containing malicious SQL, with no credentials required. The injection manipulates the backend to grant or hijack an administrator account, after which the attacker logs in as admin and pivots to the connected data sources and stored database credentials. …
Remediation Patch available per vendor advisory: upgrade Metabase to the fixed release specified in GHSA-vwf4-m7j8-wcjf and the Metabase security update post (https://www.metabase.com/blog/security-update); the exact fixed version was not included in this input and must be read from those advisories rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Isolate Metabase instances from network access or, if isolation is infeasible, implement emergency access controls restricting connectivity to management endpoints only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Metabase

View all
CVE-2023-38646 CRITICAL POC
9.8 Jul 21

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
CVE-2021-41277 HIGH POC
7.5 Nov 17

Metabase is an open source data analytics platform. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2022-43776 MEDIUM POC
6.5 Oct 26

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request For
CVE-2026-72899 CRITICAL
10.0 Aug 10

SQL injection in Metabase lets an unauthenticated remote attacker execute arbitrary SQL against the connected database b
CVE-2023-37470 CRITICAL
9.8 Aug 04

Metabase is an open-source business intelligence and analytics platform. Rated critical severity (CVSS 9.8), this vulner
CVE-2023-32680 CRITICAL
9.6 May 18

Metabase is an open source business analytics engine. Rated critical severity (CVSS 9.6), this vulnerability is remotely
CVE-2022-24853 MEDIUM POC
5.3 Apr 14

Metabase is an open source business intelligence and analytics application. Rated medium severity (CVSS 5.3), this vulne
CVE-2026-50148 CRITICAL
9.1 Jul 15

Remote code execution in Metabase (open-source business intelligence platform) versions 1.54.0 through the fixed release
CVE-2026-59826 CRITICAL
9.1 Jul 09

Remote code execution in Metabase (open-source BI/analytics platform) versions 1.55.0 through the fixed releases arises

CVE-2026-59827 HIGH
8.8 Jul 09

Remote code execution in Metabase's H2 database driver allows an authenticated user with native-query privileges to run

CVE-2022-39362 HIGH
8.8 Oct 26

Metabase is data visualization software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
CVE-2022-39361 HIGH
8.8 Oct 26

Metabase is data visualization software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-72898 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy