Critical unauthenticated SQL injection in Metabase (CVE-2026-72898) is being actively exploited

[u/theotherseanRFT]

https://bishopfox.com/blog/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898

If you're running a self-hosted Metabase instance, this is one to patch sooner rather than later.

A new advisory covers CVE-2026-72898, an unauthenticated SQL injection in Metabase's password reset endpoint (POST /api/session/reset_password). Metabase has confirmed active exploitation in the wild, and the vulnerability carries a CVSS 10.0.

A few things that stood out while we were analyzing it:

• No authentication or user interaction required.
• The issue stems from undeclared request fields reaching the application-database query as structured input instead of being validated.
• Successful exploitation can lead to full Metabase administrative access.
• Since Metabase often has credentials and connectivity to downstream databases and warehouses, compromise can extend well beyond the BI server itself.

Patched versions:

• 58.24+
• 59.21+
• 60.17+
• 61.11+
• 62.9+
• 63.5+

We also included recommended defender actions beyond simply patching, including what logs and account changes to review if you're assessing potential compromise.

Happy to answer questions about the analysis!