Vulnerability record · CVE-2026-72898 · published 10 August 2026
CVE-2026-72898: Metabase unauthenticated SQL injection in reset_password endpoint
Metabase · Metabase
Metabase exposes a database endpoint, '/reset_password', that fails to neutralize attacker-supplied SQL, allowing arbitrary SQL injection. Because the endpoint is reachable without authentication, any remote attacker who can reach the instance can abuse it to take over the connected Metabase instance. The flaw is a classic CWE-89 injection with full confidentiality, integrity and availability impact per the CVSS 4.0 vector.
Description
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
Automated analysis
critical priorityUnauthenticated remote SQL injection leading to admin takeover, CVSS 10.0, KEV-listed with known exploitation and a near-maximum EPSS score.
What it is
Metabase exposes a database endpoint, '/reset_password', that fails to neutralize attacker-supplied SQL, allowing arbitrary SQL injection. Because the endpoint is reachable without authentication, any remote attacker who can reach the instance can abuse it to take over the connected Metabase instance. The flaw is a classic CWE-89 injection with full confidentiality, integrity and availability impact per the CVSS 4.0 vector.
Impact
An attacker gains administrator access to the Metabase instance and can read or modify the connected data sources and configuration. With admin control, they can pivot to the underlying database and any data Metabase can reach.
Attack surface
Reached over the network via the '/reset_password' endpoint; the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is required. Any internet-exposed Metabase instance is directly reachable.
Exploitation
CVE-2026-72898 was added to CISA KEV on 2026-08-11 with a remediation due date of 2026-08-14, indicating known exploitation. EPSS is 0.94217 (99.8th percentile), and vendor references are tagged Patch and Mitigation.
What to do
- Apply the vendor patch from the Metabase security advisory GHSA-vwf4-m7j8-wcjf and the Metabase security update blog immediately.
- If patching is not possible, restrict network access to the '/reset_password' endpoint and remove internet exposure of Metabase instances.
- Follow CISA BOD 26-04 guidance, including discontinuing use of the product if mitigations are unavailable.
- Rotate credentials and secrets for the Metabase instance and its connected databases after patching, assuming compromise.
- Review Metabase admin accounts and configuration for unauthorized changes made before remediation.
Detection
- Search web and proxy logs for requests to '/reset_password' with SQL metacharacters or unexpected parameters.
- Monitor Metabase audit logs for new or modified admin accounts and privilege changes.
- Alert on outbound database queries from the Metabase host that deviate from normal application behavior.
- Correlate KEV/EPSS-driven scanning activity against exposed Metabase instances with authentication and configuration events.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog on 11 August 2026 as "Metabase SQL Injection Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 14 August 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf | MitigationPatchVendor Advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-72898 | VDB Entry |
| https://www.metabase.com/blog/security-update | MitigationPatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898 | US Government Resource |
Track CVE-2026-72898 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-72898), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
