CVE Tools
Sign in
Back to feed
Exploited in the wild Metabase rce auth-bypass

Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898

Bishop Fox·By Threat Enablement & Analysis Team··3 min read
CVE Tools coverage

Metabase has confirmed active exploitation of a critical, unauthenticated SQL injection vulnerability identified as CVE-2026-72898. This flaw in the password reset endpoint allows attackers to execute arbitrary SQL queries against the application database without requiring prior credentials. Organizations running self-hosted instances should immediately update to the fixed versions, including 58.24, 59.21, 60.17, 61.11, 62.9, or 63.5 and their respective later releases.

TL;DR:

Immediate action is advised for all organizations running self-hosted Metabase. A critical, unauthenticated SQL injection vulnerability has been disclosed in Metabase's password reset functionality, and Metabase has confirmed active exploitation in the wild.

Overview

The vulnerability, tracked as GHSA-vwf4-m7j8-wcjf, affects the unauthenticated POST /api/session/reset_password endpoint in Metabase. CVE designation: CVE-2026-72898">CVE-2026-72898.…

Continue reading on Bishop Fox

Related coverage

Other stories on the same CVEs
No other coverage for these CVEs yet.
Worried this affects your company?

See what your business actually exposes to the Internet — a free external review, no install, no obligation.

Check my exposure