Skip to content
Sign in
CVE-2026-7289810.0CriticalCWE-89

CVE-2026-72898: Metabase SQL Injection Vulnerability

Metabase

Vendor fix available · Affected: Metabase · Exploitation: in CISA KEV since 11 Aug

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue11 Aug
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public12 public GitHub repositories (unverified), listed by PoC-in-GitHub12 Aug
  5. Not established: not seen
98.2%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

10.0CriticalCVSS 4.0
LowCrit.

Federal deadline

CISA KEV · added 11 Aug · catalogue entry

Passed 87 days ago

DescriptionNVD

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

What changed

  1. PoC-in-GitHub lists 12 public GitHub repositories (unverified) PoC-in-GitHub
  2. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage9 articles · 5 outlets

One row per outlet, in order of first report. First in our coverage: CISA, 11 Aug.

Full timeline
Quiet for 4 weekslast report 12 Oct9 articles5 outlets
11 Aug · CISA first12 Sep28 Sep14 OctNow
  • Tue 11 Aug, 22:37 UTC. CISA, first report. CISA adds critical Metabase SQLi flaw to KEV, urges patch. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Logs CVE-2026-72898 Metabase Flaw in KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline, its first report on the story. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 17:21 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 15:48 UTC. The Hacker News, its first report on the story. Trezor Breach Exposes 67,000 US Customers Through ShipMonk. Cites a CVE in CISA KEV.
  • Tue 8 Sep, 11:01 UTC. SecurityWeek, its first report on the story. Mathspace Breach Exposes Data of 1 Million After Metabase Flaw. Cites a CVE in CISA KEV.
  • Thu 8 Oct, 17:36 UTC. The Hacker News. Japan’s Data Leaks Surge as Hackers Exploit Apps and Metabase. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
All coveragerunning total9CISA2SecurityOnl…3Security Af…1The Hacker…2SecurityWeek112 Aug12 Sep13 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
9 articles about CVE-2026-72898 from 5 outlets
Published (UTC)OutletHeadline
11 Aug 22:37CISACISA adds critical Metabase SQLi flaw to KEV, urges patch
12 Aug 00:17CISACISA Logs CVE-2026-72898 Metabase Flaw in KEV Catalog
12 Aug 13:32SecurityOnlineCVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed
13 Aug 17:21Security AffairsCISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall
17 Aug 02:40SecurityOnlineCritical Metabase SQLi flaw lets attackers seize full admin control
5 Sep 15:48The Hacker NewsTrezor Breach Exposes 67,000 US Customers Through ShipMonk
8 Sep 11:01SecurityWeekMathspace Breach Exposes Data of 1 Million After Metabase Flaw
8 Oct 17:36The Hacker NewsJapan’s Data Leaks Surge as Hackers Exploit Apps and Metabase
12 Oct 04:01SecurityOnlineActively Exploited Vulnerabilities Jump to 100 in Q3 2026
  1. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026
    SecurityOnline
  2. Japan’s Data Leaks Surge as Hackers Exploit Apps and Metabase
    The Hacker News
  3. Mathspace Breach Exposes Data of 1 Million After Metabase Flaw
    SecurityWeek
  4. Trezor Breach Exposes 67,000 US Customers Through ShipMonk
    The Hacker News
  5. Critical Metabase SQLi flaw lets attackers seize full admin control
    SecurityOnline
  6. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall
    Security Affairs · mentions it in passing
  7. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed
    SecurityOnline · mentions it in passing
  8. CISA Logs CVE-2026-72898 Metabase Flaw in KEV Catalog
    CISA · official notice
Show 1 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in