CVE-2026-72898

The vulnerability in question pertains to a critical flaw within the Metabase application, specifically allowing for SQL injection through the '/reset_password' endpoint. This security weakness arises from improper input validation, which enables an attacker to craft malicious SQL queries that can be executed against the underlying database. By exploiting this vulnerability, an attacker can manipulate database queries to extract sensitive information, modify data, or even escalate privileges to gain administrative access to the Metabase instance. The severity of this flaw is underscored by its potential to compromise the integrity and confidentiality of the entire system, leading to catastrophic consequences for organizations relying on Metabase for data analytics and business intelligence.

Attack vectors for this vulnerability are particularly concerning due to the remote and unauthenticated nature of the exploit. An attacker can initiate an SQL injection attack simply by sending a specially crafted request to the vulnerable endpoint, bypassing authentication mechanisms entirely. This opens the door to various exploitation scenarios, including but not limited to unauthorized access to sensitive data, modification of user accounts, and even the complete takeover of the Metabase instance. For instance, an attacker could reset an administrator's password, thereby locking legitimate users out of the system and gaining full control over the data and configurations. The ease of exploitation, combined with the lack of authentication requirements, makes this vulnerability a prime target for malicious actors.

The real-world impact of this vulnerability can be profound, particularly for organizations that utilize Metabase for critical business operations. The potential for data breaches is significant, as attackers could gain access to sensitive business intelligence, customer data, and proprietary information. This not only poses a risk to the organization’s reputation but also exposes it to regulatory scrutiny and financial penalties, especially if personal data is involved. Additionally, the operational disruption caused by a successful attack could lead to significant downtime, loss of productivity, and the costs associated with incident response and recovery efforts. The high CVSS score indicates that this vulnerability is not just a theoretical risk but a pressing concern that organizations must address promptly.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regular security assessments, including penetration testing and code reviews, can help identify and remediate vulnerabilities before they are exploited. Employing web application firewalls (WAFs) can provide an additional layer of protection by filtering out malicious requests targeting the vulnerable endpoint. Furthermore, organizations should ensure that they are running the latest version of Metabase, as software updates often include patches for known vulnerabilities. Implementing strict input validation and sanitization measures can also significantly reduce the risk of SQL injection attacks. Lastly, establishing robust monitoring and logging practices can aid in the early detection of suspicious activities, allowing organizations to respond swiftly to potential threats.

In conclusion, the vulnerability within the Metabase application represents a critical security risk that organizations must take seriously. The potential for remote, unauthenticated SQL injection attacks poses a significant threat to data integrity and confidentiality, with far-reaching implications for business operations. By understanding the technical details, recognizing the attack vectors, assessing the real-world impact, and implementing effective detection and mitigation strategies, organizations can better protect themselves against this and similar vulnerabilities. Proactive security measures, combined with a culture of continuous improvement, will be essential in safeguarding sensitive data and maintaining trust in the organization’s data analytics capabilities.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2026-72898, highlighted by the emergence of new proof-of-concept exploits publicly available on GitHub. This development coincides with the vulnerability’s addition to the CISA Known Exploited Vulnerabilities (KEV) catalog, underscoring its prioritization by federal cybersecurity authorities. Our telemetry indicates a sharp increase in exploitation attempts targeting Metabase instances via the unauthenticated SQL injection vector, reflecting a rapid expansion of the exploit landscape. The elevation of the CVSS score to 10.0 and the appearance of a significant EPSS score further confirm the heightened risk posture. For defenders, this means that the vulnerability is no longer theoretical but actively weaponized in the wild, increasing the likelihood of successful compromise and unauthorized administrative access. Consequently, the threat level has escalated to critical, necessitating immediate attention in detection and response strategies to mitigate potential operational and data integrity impacts.

Update 2 — August 22, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2026-72898, accompanied by the emergence of several new proof-of-concept tools that facilitate both active detection and exploitation of the Metabase SQL injection vulnerability. This expansion in the exploit landscape increases the accessibility of attack methods to a broader range of adversaries, lowering the technical barrier to compromise. Our telemetry indicates that the frequency of exploitation-related activity has grown significantly, underscoring a shift from theoretical risk to active threat. Although the EPSS score remains stable, the proliferation of publicly available exploit code and detection scripts amplifies the operational risk, as more threat actors can now weaponize this vulnerability with relative ease. Consequently, the threat level for affected Metabase instances has intensified, reinforcing the critical nature of this vulnerability and the urgency for defenders to prioritize detection and response efforts accordingly.