Metabase Pre-Auth SQL Injection (CVE-2026-72898): CVSS 10.0, Actively Exploited

Metabase, the popular open-source BI and analytics platform, has a maximum-severity flaw under active attack. CVE-2026-72898 is an unauthenticated SQL injection scored CVSS 10.0, and it is already in the CISA KEV catalog. If you run Metabase, this is a patch-today item.

What it is

An unauthenticated remote attacker can inject arbitrary SQL through the /api/session/reset_password endpoint and gain administrator access to the Metabase instance. No login, no user interaction, low attack complexity.

Admin access is where the damage compounds. From there an attacker can change the application configuration, steal the stored credentials for every connected database, read the data those connections reach, and export it. One exposed Metabase instance can become a doorway to the data warehouses behind it. The weakness class is CWE-89, SQL injection.

Who is affected

The flaw affects a range of releases across the x.58 through x.63 branches. Fixed versions are x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5. Upgrade to the patched release for your major version.

If you cannot patch right away, Metabase's mitigation is to block the /api/session/reset_password endpoint. And if that endpoint was publicly reachable, assume exposure: rotate credentials for connected databases, revoke active sessions, review API keys and admin accounts for anything unexpected, and check query and warehouse logs for unauthorized access.

Why it is urgent

Metabase discovered the attacks against its own cloud in early August, published the advisory, and shipped patches within days. CISA added it to KEV shortly after. A CVSS 10.0 with confirmed in-the-wild exploitation and a public endpoint as the entry point is about as clear a signal as prioritization gets.

Reading it on VulnTracker

The CVE-2026-72898 page in VulnTracker puts the decision on one screen. The header shows the 10.0 CRITICAL score and an "Actively Exploited" flag tied to CISA KEV, so urgency is obvious at a glance. The EPSS section shows this sitting in the top fraction of most-likely-to-be-exploited CVEs. The Affected Platforms section pulls the exact vulnerable version ranges from NVD, with a Track button to alert you on future Metabase CVEs. The KEV panel surfaces the remediation-due date so an overdue item does not slip.

The two questions that decide your afternoon, is Metabase in my stack and does my version fall in the vulnerable range, are answered in one view instead of five tabs.

What to do

Upgrade every Metabase instance to the fixed release for its branch now. If you cannot, block the reset-password endpoint and treat any previously exposed instance as potentially compromised, following the credential-rotation steps above.

Most teams never spot the few CVEs in the daily flood that actually hit their software. Closing that gap is why VulnTracker exists.

Track CVE-2026-72898 on VulnTracker — tell us you run Metabase and you'd see this in your alerts within hours of disclosure, ranked above the less-urgent CVEs from the same day, with KEV/EPSS context to brief leadership.

Start a 5-day free trial, or get our daily digest free without setting anything up.

Quick reference

References: Metabase security advisory · Horizon3 analysis · CISA KEV