The Password Reset Endpoint That Gave Away Admin: Metabase's CVE-2026-72898 and the Four Companies Behind It
A single unauthenticated POST to /api/session/reset_password was enough to reach full admin on any exposed Metabase instance. CISA's KEV deadline for it is today.
One unauthenticated request, full admin
No login, no session token, no user interaction — just a crafted POST to a password-reset endpoint. That was enough to inject arbitrary SQL into the Metabase application database and walk out with administrator access to the instance. Metabase disclosed the flaw as CVE-2026-72898 on August 6, 2026, after confirming its own Cloud platform had already been hit by "someone utilizing an unknown ('0-day') security vulnerability." By the time the advisory went public, at least four downstream companies had customer data taken through instances they ran themselves.
Scores as of 2026-08-14live record →
How the SQL injection worked
The vulnerable route is /api/session/reset_password, part of Metabase's password-reset flow — reachable without authentication by design, since a locked-out user has no session yet. Metabase's advisory (GHSA-vwf4-m7j8-wcjf) confirms the endpoint failed to properly sanitize input before it reached the application database, letting an attacker inject SQL directly. From there, the advisory states an attacker could "change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data." Metabase instances routinely hold live connection strings for Snowflake, BigQuery, Redshift, Databricks, Postgres and Mongo warehouses — so admin access to Metabase itself is a springboard into whatever it was built to visualize.
From an anonymous POST to a downstream database breach
- Unauthenticated POST /api/session/reset_password — No credentials or session required — the endpoint is reachable by design
- SQL injection into application DB — CWE-89: input reaches the query unsanitized
- Admin session established
- GET /api/user/current returns 200 — Metabase's own IoC — confirms the session works
- Read connected-database credentials
- Pivot into customer data warehouse
It wasn't the only critical bug in that disclosure
Metabase shipped three CVEs in the same advisory batch on August 10, 2026 — and the one everyone is patching for wasn't the only maximum-severity one.
| CVE | CVSS | CWE | Reachable by | In CISA KEV? | EPSS |
|---|---|---|---|---|---|
| CVE-2026-72898 | 10.0 Critical | CWE-89 SQL Injection | Unauthenticated — password-reset endpoint | Yes (added 2026-08-11) | 0.104 / 95.3rd pct |
| CVE-2026-72899 | 10.0 Critical | CWE-89 SQL Injection | Unauthenticated — public shared card/dashboard field-filter param | No | 0.006 / 44.1st pct |
| CVE-2026-72900 | 6.5 Medium | CWE-862 Missing Authorization | Authenticated, low-privileged user | No | 0.003 / 22.5th pct |
Four companies, one vendor, one bad week
None of the affected companies had a vulnerable application of their own — they had a vulnerable analytics vendor. Each ran a self-hosted or Cloud-hosted Metabase instance to build internal dashboards, and each lost customer data through it.
Disclosure timeline
- Kilo Code's Slackbot compromisedA subset of users had Slack access tokens exposed via Kilo's Metabase-connected bot; tokens were later invalidated. (TheHackerNews)
- Framework and Tally instances accessedAttackers accessed Framework's Metabase instance and Tally's Metabase analytics environment the same day. (BleepingComputer)
- Metabase discloses the 0-day, patches shipCEO Sameer Al-Sakran confirms Metabase Cloud was hit by an unknown vulnerability; GHSA-vwf4-m7j8-wcjf published; Cloud instances auto-patched.
- Framework and Tally breach details reported
- n8n discloses its incident136 customer records (names/emails) accessed; 5 included bcrypt-hashed passwords. (TheHackerNews)
- CVE-2026-72898 (and siblings) published to NVD
- CISA adds CVE-2026-72898 to the KEV catalogFederal civilian agencies given a 3-day remediation window.
- CISA KEV remediation deadline (today)
| Company | What was exposed |
|---|---|
| Framework (laptop maker) | Customer names, emails, physical addresses, phone numbers, login IPs; business customers also had company name, VAT/EIN and billing email exposed. No payment or order data. |
| Tally (form builder) | User email addresses and password hashes. Company said forms and submitted answers were unaffected — stored in a separate system. |
| n8n (workflow automation) | 136 customer records (names/emails); 5 of those included bcrypt-hashed passwords. |
| Kilo Code (AI coding agent) | Slack access tokens for a subset of users via its Metabase-connected Slackbot; tokens invalidated after discovery. |
Who's affected, and the fix
| Branch | Vulnerable range | Fixed in |
|---|---|---|
| 0.58 / 1.58 | x.58.0 – x.58.23 | x.58.24 |
| 0.59 / 1.59 | x.59.0 – x.59.20 | x.59.21 |
| 0.60 / 1.60 | x.60.0 – x.60.16 | x.60.17 |
| 0.61 / 1.61 | x.61.0 – x.61.10 | x.61.11 |
| 0.62 / 1.62 | x.62.0 – x.62.8 | x.62.9 |
| 0.63 / 1.63 | x.63.0 – x.63.3 | x.63.5 |
Every branch from 0.58 through 0.63 (and the corresponding Enterprise 1.x line) is covered — both OSS and Enterprise editions got fixes for each. Metabase Cloud customers were patched automatically; self-hosted deployments are only fixed once an admin upgrades.
If your reset-password endpoint was ever exposed
- Upgrade to the fixed release for your branch (58.24 / 59.21 / 60.17 / 61.11 / 62.9 / 63.5).
- Revoke active sessions by clearing the
core_sessiontable in the application database. - Audit API keys and remove any you don't recognize.
- Review admin accounts for unauthorized changes.
- Rotate credentials for every database or warehouse connected to the instance.
- Check downstream data-warehouse logs and Metabase's own query history for signs of unauthorized reads or exports.
Metabase's second CVSS-10, KEV-listed bug
This isn't the first time a maximum-severity, actively-exploited Metabase flaw has landed in CISA's KEV catalog. CVE-2021-41277 — an unvalidated GeoJSON map URL that exposed local files and environment variables — also scored a 10.0 and also made KEV, with an EPSS of 97.2% (99.9th percentile) at the time. Five years apart, same lesson: a self-hosted BI tool sitting on your network with database credentials attached is a high-value target the moment it's reachable from the internet.
Two CVSS-10 Metabase bugs, five years apart
- Custom GeoJSON map URL not validated
- Local file inclusion, including environment variables
- Fixed in 0.40.5 / 1.40.5
- EPSS 97.2% (99.9th pct) at time of KEV listing
- Password-reset endpoint SQL injection
- Full admin access to connected database credentials
- Fixed in 58.24–63.5 depending on branch
- EPSS 10.4% (95.3th pct) despite confirmed active exploitation
Data as of 2026-08-14live record →