---
title: "Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection"
url: https://erroneo.us/security/briefs/metabase-cve-2026-72898-reset-password-sqli/
description: "Unauthenticated SQLi in Metabase's reset_password endpoint gives admin access on versions 58-63. Fixed in 58.24 through 63.5. In KEV. Patch and rotate."
type: security-brief
section: "Security Digest"
date_published: 2026-08-06
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-72898"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection

**Verdict: Act now.** Self-hosted Metabase 58 through 63 below the fixed point releases can be taken over without a login and was attacked as a zero-day; upgrade now, and if the reset endpoint was reachable, assume your connected database credentials are burned.

- **Who must act:** Anyone self-hosting Metabase OSS or Enterprise version 58 or later below 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5 (1.x for Enterprise).
- **Who can relax:** Metabase Cloud customers (already patched, per Metabase) and self-hosted instances below version 58, which Metabase says are not vulnerable.
- **Affected:** Metabase 58 before 58.24; Metabase 59 before 59.21; Metabase 60 before 60.17; Metabase 61 before 61.11; Metabase 62 before 62.9; Metabase 63 before 63.5
- **Fixed:** v0.58.24 / v1.58.24; v0.59.21 / v1.59.21; v0.60.17 / v1.60.17; v0.61.11 / v1.61.11; v0.62.9 / v1.62.9; v0.63.5 / v1.63.5
- **CVEs:** CVE-2026-72898
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade to the minimum safe point release for your major version (e.g. metabase/metabase:v0.63.5) or later.
2. If you cannot upgrade immediately, block /api/session/reset_password at your proxy or WAF.
3. If the endpoint was publicly reachable: delete all rows from core_session in the application database to revoke sessions.
4. Review API keys and admin accounts; delete anything unrecognized.
5. Rotate credentials for every connected database and check warehouse logs and Metabase query history for unauthorized access.

### How to check if you are affected

- Look in Metabase or ingress logs for POST /api/session/reset_password returning 400 followed by GET /api/user/current returning 200 from the same client; Metabase says this likely means compromise.
- Check for unknown admin accounts, new API keys or configuration changes.
- Review data warehouse audit logs for queries or exports from Metabase's service accounts you cannot explain.

## What happened

On August 6, 2026, Metabase [told users](https://www.metabase.com/blog/security-update) that Metabase Cloud had been attacked through an unknown ("0-day") vulnerability affecting versions 58 and above. The company blocked the endpoints the attacker used, patched Cloud, and shipped fixed point releases for every affected self-hosted line. The [GitHub advisory](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf) describes the bug as letting an unauthenticated remote attacker inject arbitrary SQL into the Metabase application database. That can give them administrator access to the instance. From there they can change configuration, steal stored credentials for connected databases, and read and export any data those connections reach. Metabase states it has confirmed active exploitation.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-72898), issued by CISA's CNA on August 10, puts the injection point in the `reset_password` endpoint and scores it 10.0 under both CVSS 4.0 and 3.1. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898) on August 11. The same [CISA CSAF advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json) lists two further Metabase issues fixed in the same releases, neither marked as exploited: CVE-2026-72899, a SQL injection through publicly shared cards or dashboards with field filters, and CVE-2026-72900, an authenticated read of the application database.

## Who is affected

Self-hosted Metabase OSS (0.x) and Enterprise (1.x), versions 58 through 63, below these minimum safe releases: 58.24, 59.21, 60.17, 61.11, 62.9 and 63.5. Metabase says versions below 58 are not vulnerable and Cloud instances are already patched. Find your version under the gear or grid icon, About Metabase.

## Do you really need to act?

Yes, if you are in the affected range. No login is needed, the attack has been used against Metabase's own cloud, and CISA rates it automatable with total technical impact. The blast radius is larger than the BI tool. Metabase holds working credentials for your production databases and warehouses, often with broad read access. An attacker with admin rights gets a ready-made data-exfiltration console.

Instances reachable only over a VPN are less exposed, but the endpoint behind a password-reset flow is usually left open on purpose. The upgrade is a point release within your major version, so there is little reason to wait.

## What to do now

1. Upgrade to the safe point release for your major version or later. Docker example: `docker pull metabase/metabase:v0.63.5` (Enterprise: `metabase/metabase-enterprise:v1.63.5`). JAR builds are on downloads.metabase.com.
2. If you cannot upgrade today, block `/api/session/reset_password` at the reverse proxy, load balancer or WAF.
3. If that endpoint was publicly reachable, then after upgrading revoke every session by deleting all rows in `core_session` (for example `DELETE FROM core_session;` in the application database).
4. Review API keys and administrator accounts, and delete anything you don't recognize.
5. Rotate credentials for every connected database, then review warehouse logs and Metabase activity and query history for unauthorized use.

## How to tell if you were hit

Metabase describes a specific pattern: `POST /api/session/reset_password` returning **400**, followed by `GET /api/user/current` returning **200**. If you see it in application or ingress logs, Metabase says your instance has likely been compromised. A quick check might be `grep -E 'reset_password|/api/user/current' access.log` on your proxy logs. Also look for new admins, unfamiliar API keys, changed settings, and queries or exports in the warehouse from Metabase's service accounts that no one can account for.

## Timeline

- Aug 6, 2026 — Metabase discloses the zero-day attack on Cloud and publishes the fixed releases and GHSA-vwf4-m7j8-wcjf.
- Aug 10, 2026 — CVE-2026-72898 is published, along with CISA CSAF advisory VA-26-222-01.
- Aug 11, 2026 — CISA adds CVE-2026-72898 to KEV, due Aug 14.

## Sources

1. [Metabase — Security update available for Metabase - Please upgrade now](https://www.metabase.com/blog/security-update)
2. [Metabase / GitHub — GHSA-vwf4-m7j8-wcjf: SQL injection using an unauthenticated endpoint leading to admin access](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
3. [CVE record — CVE-2026-72898](https://www.cve.org/CVERecord?id=CVE-2026-72898)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-72898](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898)
5. [CISA — CSAF advisory VA-26-222-01 (Metabase SQL injection)](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json)
6. [NVD — CVE-2026-72898](https://nvd.nist.gov/vuln/detail/CVE-2026-72898)

---
Source page: https://erroneo.us/security/briefs/metabase-cve-2026-72898-reset-password-sqli/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt