CVE-2026-72898

What is Metabase?

Metabase is a widely deployed open-source business intelligence and analytics platform. Teams point it directly at production databases and data warehouses so that non-engineers can build dashboards and run queries without writing SQL. To do that, Metabase stores the connection credentials for every data source it queries inside its own application database.

That architecture is what makes a Metabase compromise so severe. The platform is not merely one application among many — it is a credential vault sitting in front of an organization's most sensitive data stores, and it is frequently deployed on the public internet so that remote staff can reach dashboards. Wiz reports that roughly 13% of cloud environments contain a self-hosted Metabase instance and that about 25% of those are fully internet-accessible; Shodan inventories roughly 2,500 internet-facing instances.

Overview

CVE-2026-72898 is an unauthenticated SQL injection in Metabase's password reset endpoint. A single unauthenticated HTTP request injects arbitrary SQL into the Metabase application database, which is enough to grant the attacker administrator access to the instance. From there, an attacker can alter application configuration, extract the stored credentials for every connected database, read any data reachable through those connections, and export it.

This was exploited as a zero-day. Metabase discovered the flaw by detecting a live attack against its own hosted infrastructure, and public proof-of-concept exploits followed within days of the patch. The CVSS score of 10.0 reflects a Changed scope: compromising Metabase does not stop at Metabase, because it hands the attacker the keys to the downstream data warehouses.

Affected Versions

Applies to self-hosted deployments on the 0.58/1.58 branch and later; Enterprise 1.x builds track the same numbering. Metabase Cloud was patched by the vendor.

Technical Details

The vulnerable endpoint is POST /api/session/reset_password. The injection is not the textbook case of string-concatenated SQL — it is reached by chaining three separate permissive behaviours in the request-handling path:

1. The endpoint does not reject undeclared fields. Extra keys in the JSON request body are carried forward rather than discarded.
2. A Clojure merge combines the request map with the authentication result without stripping those extra keys. Critically, this happens even when authentication fails — so an attacker-supplied user-id key survives the merge intact.
3. HoneySQL's :raw directive bypasses parameterization. JSON keywordization turns a body such as {"user-id":{"raw":"<SQL>"}} into the Clojure map {:user-id {:raw "<SQL>"}}. When that map reaches t2/select-one :id user-id (Toucan 2), the query builder honours :raw and embeds the attacker's string as literal SQL.

The fix validates the value as a positive integer before it reaches the query builder — roughly (if (pos-int? user-id) ... (log/warnf ...)).

CWE-89 in this context: the classic SQL injection failure mode, but reached through a structured query-DSL escape hatch rather than string concatenation. Parameterized queries were in use; the :raw directive is an intentional bypass of them, and mass-assignment of an unexpected field is what let an attacker reach it.

Attack characteristics:

• Authentication required: none — the endpoint is pre-auth by design.
• Attack complexity: low. No user interaction.
• Chaining: none required. A single HTTP request yields administrator access.
• Scope: Changed — impact extends beyond Metabase to every database whose credentials it stores.

Discovery

There is no external researcher credit for this vulnerability. Metabase discovered it internally on 2026-08-02 by detecting an actual attack in progress against Metabase Cloud — incident-response-driven discovery rather than coordinated disclosure. Wiz, Bishop Fox, and Horizon3.ai published independent reverse-engineering analyses after the vendor advisory shipped.

Exploitation Context

• Zero-day. Exploitation predates both the patch and the public disclosure, with the first known attack on 2026-08-02.
• Confirmed downstream victims. Between 2026-08-07 and 2026-08-10, several organizations publicly disclosed breaches traced to this vulnerability, including Framework, n8n, Tally, Anaconda / Kilo Code, and ChecklyHQ.
• Public exploits released 2026-08-10, sharply widening the population capable of exploiting it and turning a targeted zero-day into commodity attack tooling within days.
• CISA assigned a three-day remediation deadline (added 08-11, due 08-14), one of the most aggressive windows the KEV catalog uses.
• Threat actor attribution: none published. No source names an APT, ransomware crew, or botnet operator behind the original zero-day activity.

Remediation

1. Upgrade immediately to 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (or later) as appropriate to your branch. Metabase Cloud tenants are already patched.
2. Interim workaround if you cannot patch now: block /api/session/reset_password at the reverse proxy or WAF. This disables self-service password reset, so treat it as a stopgap only.
3. Do not treat patching as sufficient — assume credential compromise. Rotate every database connection credential stored in Metabase, all API keys, and all admin passwords and sessions. The vulnerability's primary payoff is credential theft, and patching does not invalidate what was already taken.
4. Audit for persistence. Review the admin user list for accounts created or elevated since late July 2026, and review any changes to data source configuration.
5. Review logs for exploitation. Hunt for POST /api/session/reset_password requests whose body contains a user-id key holding a nested JSON object — particularly one with a raw key containing SQL. Legitimate requests carry a scalar integer, so a nested object at that key is a reliable indicator. Extend the review to data warehouse query logs and Metabase query history for anomalous access or bulk export activity.
6. Get Metabase off the public internet. Place it behind SSO or a VPN. Roughly a quarter of self-hosted instances are directly internet-accessible, which is what made this bug mass-exploitable.