Skip to main content

Metabase CVE-2026-72899

| EUVDEUVD-2026-55691 CRITICAL
SQL Injection (CWE-89)
2026-08-10 cisa-cg
SQLi Metabase
10.0
CVSS 4.0 · Vendor: cisa-cg
Share

Severity by source

Vendor (cisa-cg) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Unauthenticated network SQLi with no user interaction (PR:N/UI:N/AV:N/AC:L); injection reaches the backend database beyond Metabase's security scope (S:C) with full read/write/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 18:36 vuln.today
CVE Published
Aug 10, 2026 - 17:56 cve.org
CRITICAL 10.0

DescriptionCVE.org

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

AnalysisAI

SQL injection in Metabase lets an unauthenticated remote attacker execute arbitrary SQL against the connected database by abusing a field-filter (dimension) parameter exposed through a publicly shared card or dashboard. Because public sharing requires no login, any internet-reachable Metabase instance with a shared object that surfaces a field-filter parameter is exploitable with a single crafted request. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Locate internet-facing Metabase public share
Delivery
Identify field-filter parameter on shared object
Exploit
Inject crafted SQL into dimension parameter
Execution
Backend database executes attacker query
Impact
Exfiltrate or modify database data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target Metabase instance has public sharing enabled and at least one publicly shared card or dashboard that exposes a field-filter (dimension) parameter - that shared, filterable public object is the exact prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine top-priority issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker discovers an internet-facing Metabase instance that has a public dashboard link containing a field-filter parameter. Without any credentials, they send a single crafted HTTP request that injects malicious SQL into that dimension parameter, causing the backend database to execute attacker-controlled queries. …
Remediation Patch available per vendor advisory: upgrade to the fixed Metabase release identified in the GitHub Security Advisory GHSA-r8h2-qpfx-mx59 (https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59); the exact fixed version is not stated in the provided data, so confirm it against that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: disable public sharing in all Metabase instances and audit all previously shared cards or dashboards for field-filter parameters. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Metabase

View all
CVE-2026-72898 CRITICAL POC
10.0 Aug 10

SQL injection in Metabase's '/reset_password' database endpoint lets a remote, unauthenticated attacker inject arbitrary
CVE-2023-38646 CRITICAL POC
9.8 Jul 21

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
CVE-2021-41277 HIGH POC
7.5 Nov 17

Metabase is an open source data analytics platform. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2022-43776 MEDIUM POC
6.5 Oct 26

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request For
CVE-2023-37470 CRITICAL
9.8 Aug 04

Metabase is an open-source business intelligence and analytics platform. Rated critical severity (CVSS 9.8), this vulner
CVE-2023-32680 CRITICAL
9.6 May 18

Metabase is an open source business analytics engine. Rated critical severity (CVSS 9.6), this vulnerability is remotely
CVE-2022-24853 MEDIUM POC
5.3 Apr 14

Metabase is an open source business intelligence and analytics application. Rated medium severity (CVSS 5.3), this vulne
CVE-2026-50148 CRITICAL
9.1 Jul 15

Remote code execution in Metabase (open-source business intelligence platform) versions 1.54.0 through the fixed release
CVE-2026-59826 CRITICAL
9.1 Jul 09

Remote code execution in Metabase (open-source BI/analytics platform) versions 1.55.0 through the fixed releases arises

CVE-2026-59827 HIGH
8.8 Jul 09

Remote code execution in Metabase's H2 database driver allows an authenticated user with native-query privileges to run

CVE-2022-39362 HIGH
8.8 Oct 26

Metabase is data visualization software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
CVE-2022-39361 HIGH
8.8 Oct 26

Metabase is data visualization software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-72899 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy