CVE-2026-72898

Metabase SQL injection via password reset endpoint

Published: Aug 10, 2026Updated: Aug 12, 2026 Sources: CVE List NVD csafCWE-89

10.0CRITICAL

Description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

In plain language

AI Act now

CVE-2026-72898 is a serious Metabase flaw where attackers can use the password reset feature to run SQL and take over the Metabase site; if your business runs Metabase and it’s reachable from the internet, you should act immediately.

Executive summary

CVE-2026-72898 is a CWE-89 SQL injection in Metabase’s password reset endpoint that allows remote, unauthenticated attackers to inject SQL and gain administrator-level impact; it has been confirmed in CISA KEV with a near-term remediation deadline.

If affected, business impact

Full Metabase admin takeoverData theft from MetabaseSQL manipulation and service disruptionBusiness reporting integrity loss

What to do now

Check whether the affected Metabase instance is exposed to the internet and can reach the password reset endpoint (/reset_password).
Identify your current Metabase version and whether it falls before the fixed releases.
Upgrade Metabase to a fixed version: 0.58.24, x.59.21, x.60.17, x.61.11, x.62.9, or x.63.5.
If you cannot patch right now, restrict access so the Metabase app and its password reset endpoint are not reachable from the internet, and follow Metabase/CISA mitigation guidance while you plan the upgrade.

Patch / advisory Usually a quick update

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-89

Affected Products

Metabase

commercialaka metabase.com

MetabaseSaaS

Enterprise Software / bi-reporting

and 1 more affected products View all →

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Aug 11, 2026

Remediation due:Aug 14, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-72898?We'll check your whole external perimeter for exposure — free. Check my exposure