CVE-2026-72898

This is a bug in Metabase’s password reset process that can let a bad actor run database commands they shouldn’t be able to run. If the attacker can reach it, they can potentially seize administrator control of your Metabase instance and then access or damage your business data and reports—like breaking into the control panel of your reporting dashboard.

This matters if your business uses Metabase (self-hosted or hosted) and the Metabase web app is reachable from the internet. It is specifically tied to the password reset endpoint, so exposure depends on whether that endpoint can be reached by an attacker over the network. Based on the confirmed exploitation listing, treat it as a risk when Metabase is internet-reachable (and particularly if the password reset endpoint is accessible).

This is urgent because it is listed in CISA KEV (confirmed real-world exploitation) and the CISA remediation due date has already passed. Treat it as an active, high-impact takeover risk for Metabase instances that are reachable from the internet.

1. Confirm exposure

• Determine whether your Metabase instance is reachable from the internet (for example, via your public domain or load balancer).
• Verify whether the password reset endpoint is accessible externally (the relevant path is /reset_password).

2. Confirm version

• Log into your Metabase admin area (or check the deployment metadata) to find the exact Metabase version.
• Compare it to the fixed versions listed by Metabase: 0.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5.

3. Upgrade to the fixed release

• Upgrade to the fixed version that matches your release line.
• Use Metabase’s release notes and the security advisory linked in the findings to ensure you follow any upgrade steps they call out.

4. If patching is delayed (temporary containment)

• Restrict network access so the Metabase app (and specifically the password reset endpoint) is not reachable from the public internet.
• Apply the mitigations in accordance with the vendor instructions referenced in CISA KEV.
• If you cannot mitigate internet exposure, discontinue use of the product until mitigations are in place (per CISA KEV guidance).

5. After upgrading

• Review authentication/administrative activity in Metabase and connected systems around the time of exposure.
• Check for unexpected admin users, unusual SQL/database activity, or configuration changes.

CISA KEV timeline from the findings

• Added to CISA KEV: 2026-08-11
• Remediation due date: 2026-08-14

What to monitor

• Unexpected logins or admin role changes in Metabase.
• Changes to scheduled jobs, query activity patterns, and any database-side behavior consistent with tampering.

CVE-2026-72898 is a high-severity SQL injection (CWE-89) in Metabase’s password reset endpoint (/reset_password). The findings indicate remote, unauthenticated attacker reachability and administrator-level impact when the endpoint is accessible; CISA includes it in its KEV, which is used for tracking vulnerabilities actively exploited in the wild. The findings also state that no public exploit code is on record, but exploitation is still treated as confirmed due to KEV listing and related press/exploitation signals.

Fix status

• Metabase has fixed the issue in versions: 0.58.24; x.59.21; x.60.17; x.61.11; x.62.9; x.63.5.

Exploit maturity indicators

• KEV confirmation is the dominant signal for real-world risk.
• EPSS is reported as rising, but public owner-facing urgency should rely primarily on KEV confirmation rather than prediction.