> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-72898 — Metabase Metabase: Metabase SQL Injection Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-72898-metabase-metabase-metabase-sql-injection-vulnerability/ - Published: 2026-08-11T22:23:16.000Z - Updated: 2026-08-11T22:23:16.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-72898 ## 1\. Executive summary CVE-2026-72898 is a CVSS 10.0 CRITICAL SQL injection vulnerability (CWE-89) in Metabase, the open-source business intelligence and data visualisation platform. The flaw allows an unauthenticated, remote attacker to inject arbitrary SQL via the `/reset_password` database endpoint, granting administrator access to the Metabase instance. CISA's SSVC record was updated on 2026-08-11 to reflect "active" exploitation; however, per the VERIFIED REFERENCE DATA, this CVE is NOT currently listed in the CISA KEV catalogue (EPSS 1%). The blast radius is significant for EMEA financial services: once administrator access is achieved, an attacker can alter application configuration, extract stored credentials for downstream connected databases, and exfiltrate data from those connections. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19 — reporting of major ICT-related incidents to competent authorities | Active exploitation of a CVSS 10.0 unauthenticated SQL injection in a BI tool that stores credentials for connected databases, potentially enabling unauthorised data access across multiple downstream data stores. | If a Metabase instance is confirmed compromised, the incident likely meets the classification threshold for a major ICT-related incident requiring authority notification under Art. 19\. Clients must assess impact scope across all connected databases. | | DORA Art. 24 — digital operational resilience testing — general requirements | A CVSS 10.0 vulnerability with active exploitation in an internet-exposed analytics platform that processes or connects to financial data sources. | Clients must include Metabase instances in their resilience testing scope and verify patch status as part of ongoing operational resilience programmes. | ## 3\. Technical analysis & attack chain ### Confirmed attack chain 1. **Initial access (unauthenticated, remote):** The attacker sends a crafted request to the `/reset_password` database endpoint of a Metabase instance. No authentication is required (CVSS 3.1 vector: `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`). 2. **SQL injection into application database:** The `/reset_password` endpoint fails to properly neutralise special elements in the SQL command (CWE-89), allowing the attacker to inject arbitrary SQL into the Metabase application (H2) database. 3. **Privilege escalation to administrator:** Through the SQL injection, the attacker modifies the application database to elevate their privileges or create an administrator-level session, gaining full control of the Metabase instance. 4. **Configuration tampering:** With administrator access, the attacker can change application configuration, including settings governing database connections, user access, and data export policies. 5. **Credential theft:** The attacker extracts stored credentials for all databases connected to the Metabase instance. Metabase stores connection strings and credentials for downstream data sources (e.g., PostgreSQL, MySQL, Snowflake, Redshift) to enable its analytics queries. 6. **Data access and exfiltration:** Using the stolen credentials, the attacker can query, read, and export data from every connected downstream database — potentially spanning the entire data estate the Metabase instance was configured to analyse. ### Technical specifics - **Vulnerable component:** Metabase application, `/reset_password` database endpoint. - **Attack vector:** Network, low complexity, no privileges required, no user interaction. - **CVSS 4.0 (CNA — CISA):** `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` — full impact across primary and secondary systems. - **Scope:** Changed (S:C in v3.1) — exploitation impacts resources beyond the vulnerable component (i.e., downstream connected databases). **Exploitation status — discrepancy note:** The VERIFIED REFERENCE DATA classifies CVE-2026-72898 as NOT in CISA KEV with EPSS 1%. However, CISA's SSVC change history for this CVE record shows the exploitation metric was updated from "none" to "active" on 2026-08-10 and again confirmed as "active" on 2026-08-11\. The Hacker News and Dark Reading corroborate in-the-wild zero-day exploitation. The KEV catalogue listing and the SSVC exploitation field are separate data points; the absence from KEV at time of writing does not contradict the SSVC "active" determination. Treat as actively exploited. **Attribution:** No threat actor attribution is present in any source material. No MITRE ATT&CK actor profile is available in the verified reference data. Attribution is unconfirmed. **Confidence caveat:** The `/reset_password` endpoint as the specific injection point is sourced from the NVD record (CNA: CISA). The exploitation-in-the-wild claim is corroborated by The Hacker News and Dark Reading, and by CISA's SSVC change history. The downstream credential theft and data exfiltration capability is described in the NVD/CISA primary advisory text. No specific IOCs, malware families, or attacker infrastructure are provided in any source. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Inventory and assess exposure:** Identify all Metabase instances in the estate. Determine which are internet-facing. For each, enumerate all connected downstream databases and the sensitivity of data accessible through those connections. - **Isolate internet-facing instances:** If Metabase instances are exposed to the public internet, place them behind a VPN or zero-trust network access gateway immediately. The `/reset_password` endpoint should not be reachable by unauthenticated external users under any circumstance. - **Block the attack vector:** Apply WAF or reverse-proxy rules to inspect and filter SQL injection patterns targeting the `/reset_password` endpoint. At minimum, restrict access to this endpoint to authenticated internal users only. - **Hunt for compromise:** Review Metabase application database logs and access logs for anomalous requests to `/reset_password`. Check for unauthorised administrator account creation, configuration changes, or unusual database connection activity. Review downstream database access logs for queries originating from the Metabase host outside expected usage patterns. ### P2 — within 72 hours - **Apply vendor patch:** Apply the Metabase vendor fix as soon as it is available. Monitor the Metabase security advisories page and the NVD record for patch availability. The NVD record is still undergoing enrichment; confirm the fixed version with the vendor directly. - **Rotate downstream credentials:** For any Metabase instance that was internet-facing or shows signs of anomalous activity, rotate all stored database connection credentials. Assume stored credentials are compromised if the instance was exposed. - **Review Metabase configuration:** Audit administrator accounts, API tokens, and database connection configurations for unauthorised changes. Remove any unrecognised accounts or tokens. ### P3 — within 7 days - **Network segmentation:** Ensure Metabase instances are segmented from critical data stores. Apply least-privilege database credentials — Metabase service accounts should have read-only access to the minimum schema set required, never broad database access. - **Credential storage review:** Evaluate whether Metabase's credential storage mechanism meets your organisation's secrets management policy. Consider whether database connections can be brokered through a secrets manager rather than stored in the application database. - **Patch all instances:** Ensure all Metabase instances — including internal-only deployments — are patched to the fixed version. ## 5\. Indicators of compromise No atomic indicators of compromise (IPs, domains, hashes, URLs) are available in the source material. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------- | | Unauthenticated POST/GET requests to /reset\_password endpoint containing SQL injection payloads | Metabase application logs, WAF logs, reverse proxy access logs | High — endpoint and attack vector confirmed in NVD record | | New administrator account creation in Metabase without corresponding legitimate user provisioning workflow | Metabase application database (application\_db), Metabase admin audit log | Medium — consistent with described privilege escalation outcome | | Unauthorised changes to Metabase application configuration (database connections, settings, SMTP, JWT) | Metabase admin settings audit log, application database setting table | Medium — described as attacker capability in advisory text | | Unusual outbound database connections from Metabase host to downstream data stores outside normal query patterns | Network flow logs, downstream database audit logs (PostgreSQL pg\_stat\_activity, MySQL general log, Snowflake QUERY\_HISTORY) | Medium — consistent with described credential theft and data access | | Bulk data export or SELECT queries from downstream databases initiated by Metabase service account outside business hours or at abnormal volume | Downstream database audit logs, DLP alerts | Medium — consistent with described data exfiltration capability | ## 6\. Detection Insufficient indicators to author detection rules. No distinctive strings, command-line flags, mutex names, file paths, registry keys, or hard-coded values from the threat itself are present in the source material. The `/reset_password` endpoint path is a legitimate application route, not a threat artefact. Recommend deploying WAF rules with SQL injection signature sets targeting the `/reset_password` path and monitoring Metabase application logs for unauthenticated access to this endpoint as described in §5 behavioural indicators. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | --------- | ---- | --------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-72898](https://nvd.nist.gov/vuln/detail/CVE-2026-72898?ref=f4n6.co.uk) | 10.0 Critical | — | 1% | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset\_password' database endpoint and gain… | ## 7\. Sources - NVD / CISA — CVE-2026-72898 detail page — https://nvd.nist.gov/vuln/detail/CVE-2026-72898 — 2026-08-10 - Dark Reading — "Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius" — https://www.darkreading.com/vulnerabilities-threats/metabase-sql-zero-day-attacks-wide-blast-radius — 2026-08 - The Hacker News — "Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication" — https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html — 2026-08 - BSI Germany — WID-SEC-2026-2715: "Metabase: Schwachstelle ermöglicht SQL-Injection und Privilegieneskalation" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2715 — 2026-08 - BSI Germany — WID-SEC-2026-2738: "Metabase: Mehrere Schwachstellen" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2738 — 2026-08 ## 8\. Adverse Trace position CVE-2026-72898 is a maximum-severity (CVSS 10.0) unauthenticated SQL injection in Metabase with confirmed active exploitation per CISA SSVC, though it is not yet listed in the CISA KEV catalogue (EPSS 1% — likely due to the record's recency and ongoing NVD enrichment). The threat to EMEA financial services is elevated because Metabase instances typically aggregate credentials for multiple downstream databases containing sensitive financial and customer data; a single compromise can cascade into broad data exfiltration across the connected data estate. Clients should treat this as a P1 priority: isolate internet-facing instances within 24 hours, hunt for compromise using the behavioural indicators in §5, apply the vendor patch when available, and rotate all downstream database credentials for any instance that was exposed. We will monitor for KEV catalogue addition, vendor patch release, and emergence of IOCs or actor attribution, and will issue an update if the threat picture materially changes. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-72898?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*