A critical SQL injection flaw in Metabase (CVE‑2026‑72898) has been added to the CISA Known Exploited Vulnerabilities catalogue, allowing unauthenticated attackers to gain full administrative control of affected BI servers CISA alert weekly threat intelligence report. The vulnerability impacts all versions prior to the patched release and can be exploited without any authentication.
CVE‑2026‑72898 carries a CVSS score of 10 and resides in the Metabase search filter endpoint where user‑supplied input is incorrectly concatenated into SQL queries. Attackers can inject arbitrary SQL statements to dump database contents, extract password hashes and, through the integrated H2 console, achieve remote code execution on the host.
Exploitation requires only a crafted GET parameter; no credentials are needed. Threat analysts have observed the Lazarus Group chaining this flaw with the Windows zero‑day CVE‑2026‑68820, delivering malware via fake job‑offer phishing lures that first compromise a workstation and then pivot to the Metabase server Lazarus job‑offer article.
Active exploitation has been confirmed by CISA, which cited the Metabase issue alongside a Cisco Secure Firewall heap flaw and a Windows use‑after‑free bug in its latest KEV update CISA adds Metabase article. The same Patch Tuesday that addressed CVE‑2026‑68820 also saw Microsoft resolve over 400 other vulnerabilities Microsoft fixes 400 flaws.
The activity highlights a growing trend where adversaries chain web‑application vulnerabilities with operating‑system zero‑days to move laterally inside target networks, reinforcing the importance of rapid patching and network segregation Lazarus post‑quantum key exchange article.
Defenders should apply the Metabase update immediately, restrict direct internet access to the service and place it behind a strong web‑application firewall that blocks typical SQLi patterns. Network segmentation must limit communication between the Metabase host and critical databases, while monitoring logs for unusual query patterns or privileged account usage.
Additional measures include enforcing least‑privilege database accounts, enabling multi‑factor authentication for administrative consoles and auditing any third‑party plugins or extensions. Windows systems should be kept current with the patch for CVE‑2026‑68820, and users need regular training to recognise fraudulent job‑offer phishing attempts. Subscribing to threat‑intel feeds that track the KEV catalogue will help organisations stay ahead of similar chained attacks.