Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection

What to do

1. Upgrade to the minimum safe point release for your major version (e.g. metabase/metabase:v0.63.5) or later.
2. If you cannot upgrade immediately, block /api/session/reset_password at your proxy or WAF.
3. If the endpoint was publicly reachable: delete all rows from core_session in the application database to revoke sessions.
4. Review API keys and admin accounts; delete anything unrecognized.
5. Rotate credentials for every connected database and check warehouse logs and Metabase query history for unauthorized access.

How to check if you are affected or compromised

• Look in Metabase or ingress logs for POST /api/session/reset_password returning 400 followed by GET /api/user/current returning 200 from the same client; Metabase says this likely means compromise.
• Check for unknown admin accounts, new API keys or configuration changes.
• Review data warehouse audit logs for queries or exports from Metabase's service accounts you cannot explain.

What happened#

On August 6, 2026, Metabase told users that Metabase Cloud had been attacked through an unknown ("0-day") vulnerability affecting versions 58 and above. The company blocked the endpoints the attacker used, patched Cloud, and shipped fixed point releases for every affected self-hosted line. The GitHub advisory describes the bug as letting an unauthenticated remote attacker inject arbitrary SQL into the Metabase application database. That can give them administrator access to the instance. From there they can change configuration, steal stored credentials for connected databases, and read and export any data those connections reach. Metabase states it has confirmed active exploitation.

The CVE record, issued by CISA's CNA on August 10, puts the injection point in the reset_password endpoint and scores it 10.0 under both CVSS 4.0 and 3.1. CISA added it to the KEV catalog on August 11. The same CISA CSAF advisory lists two further Metabase issues fixed in the same releases, neither marked as exploited: CVE-2026-72899, a SQL injection through publicly shared cards or dashboards with field filters, and CVE-2026-72900, an authenticated read of the application database.

Who is affected#

Self-hosted Metabase OSS (0.x) and Enterprise (1.x), versions 58 through 63, below these minimum safe releases: 58.24, 59.21, 60.17, 61.11, 62.9 and 63.5. Metabase says versions below 58 are not vulnerable and Cloud instances are already patched. Find your version under the gear or grid icon, About Metabase.

Do you really need to act?#

Yes, if you are in the affected range. No login is needed, the attack has been used against Metabase's own cloud, and CISA rates it automatable with total technical impact. The blast radius is larger than the BI tool. Metabase holds working credentials for your production databases and warehouses, often with broad read access. An attacker with admin rights gets a ready-made data-exfiltration console.

Instances reachable only over a VPN are less exposed, but the endpoint behind a password-reset flow is usually left open on purpose. The upgrade is a point release within your major version, so there is little reason to wait.

What to do now#

1. Upgrade to the safe point release for your major version or later. Docker example: docker pull metabase/metabase:v0.63.5 (Enterprise: metabase/metabase-enterprise:v1.63.5). JAR builds are on downloads.metabase.com.
2. If you cannot upgrade today, block /api/session/reset_password at the reverse proxy, load balancer or WAF.
3. If that endpoint was publicly reachable, then after upgrading revoke every session by deleting all rows in core_session (for example DELETE FROM core_session; in the application database).
4. Review API keys and administrator accounts, and delete anything you don't recognize.
5. Rotate credentials for every connected database, then review warehouse logs and Metabase activity and query history for unauthorized use.

How to tell if you were hit#

Metabase describes a specific pattern: POST /api/session/reset_password returning 400, followed by GET /api/user/current returning 200. If you see it in application or ingress logs, Metabase says your instance has likely been compromised. A quick check might be grep -E 'reset_password|/api/user/current' access.log on your proxy logs. Also look for new admins, unfamiliar API keys, changed settings, and queries or exports in the warehouse from Metabase's service accounts that no one can account for.

Timeline#

• Aug 6, 2026 — Metabase discloses the zero-day attack on Cloud and publishes the fixed releases and GHSA-vwf4-m7j8-wcjf.
• Aug 10, 2026 — CVE-2026-72898 is published, along with CISA CSAF advisory VA-26-222-01.
• Aug 11, 2026 — CISA adds CVE-2026-72898 to KEV, due Aug 14.

Vulnerability records

• CVE-2026-72898 · KEV 2026-08-11 · Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Metabase — Security update available for Metabase - Please upgrade now metabase.com
2. Metabase / GitHub — GHSA-vwf4-m7j8-wcjf: SQL injection using an unauthenticated endpoint leading to admin access github.com
3. CVE record — CVE-2026-72898 cve.org
4. CISA — Known Exploited Vulnerabilities: CVE-2026-72898 cisa.gov
5. CISA — CSAF advisory VA-26-222-01 (Metabase SQL injection) raw.githubusercontent.com
6. NVD — CVE-2026-72898 nvd.nist.gov