【Urgent】Metabase CVE-2026-72898: Update to Immediate Fix Version — Risk of Administrator Privilege Takeover

An unauthenticated SQL injection vulnerability (CVE-2026-72898) with a severity score of 10.0 (Critical) has been discovered in the Business Intelligence (BI) platform 'Metabase.' This vulnerability has been confirmed to be actively exploited in real-world attacks, allowing remote attackers to gain administrator privileges without authentication, steal sensitive information from the database, and modify application settings. It has been added to CISA's KEV (Known Exploited Vulnerabilities) catalog, with a remediation deadline of August 14th.

Immediate Actions to Take

• ✓Update to the patched version as confirmed by official sources.
• ✓Apply official workarounds until the update can be performed.
• ✓Check for signs of compromise.

Vulnerability Overview and Scope of Impact

CVE-2026-72898 is an unauthenticated SQL injection vulnerability residing in Metabase's password reset functionality (the /api/session/reset_password endpoint). Attackers can exploit this endpoint to inject arbitrary SQL queries into the Metabase application database. This allows them to obtain administrator access to a Metabase instance without authentication. The U.S. CISA added this vulnerability to its KEV catalog on August 11, 2026, warning that it is being actively exploited.

Specific Impacts and Attack Scenarios

If this vulnerability is exploited, attackers could cause widespread impacts, including the following:

• ✓Obtaining administrator access to the Metabase application database
• ✓Modifying application settings
• ✓Stealing stored credentials for connected databases
• ✓Reading and exporting any data accessible via Metabase

According to research by runZero, approximately 4,309 out of about 11,000 internet-exposed self-hosted Metabase deployments may be running vulnerable versions. This includes critical infrastructure sectors such as government, healthcare, energy, finance, telecommunications, and aviation, putting these organizations at risk of data breaches and system takeovers. In fact, over 97% of vulnerable versions are reportedly unpatched. This vulnerability is extremely severe as it requires no authentication, no user interaction, and has low attack complexity.

Response Procedures and Verification Methods

If you are using self-hosted Metabase, a prompt update to the following patched versions is mandatory. Metabase Cloud users have already had the patch applied.

【Affected Versions】<br>・Metabase 0.58.0 to 0.58.23 (Enterprise 1.58.0 to 1.58.23)<br>・Metabase 0.59.0 to 0.59.20 (Enterprise 1.59.0 to 1.59.20)<br>・Metabase 0.60.0 to 0.60.16 (Enterprise 1.60.0 to 1.60.16)<br>・Metabase 0.61.0 to 0.61.10 (Enterprise 1.61.0 to 1.61.10)<br>・Metabase 0.62.0 to 0.62.8 (Enterprise 1.62.0 to 1.62.8)<br>・Metabase 0.63.0 to 0.63.4 (Enterprise 1.63.0 to 1.63.4)<br>※Versions below 0.58/1.58 are not affected.

【Patched Versions】<br>・Metabase 0.58.24 / 1.58.24 and later<br>・Metabase 0.59.21 / 1.59.21 and later<br>・Metabase 0.60.17 / 1.60.17 and later<br>・Metabase 0.61.11 / 1.61.11 and later<br>・Metabase 0.62.9 / 1.62.9 and later<br>・Metabase 0.63.5 / 1.63.5 and later

After updating, follow these steps to check for signs of compromise and consider further action.

• ✓Invalidate all Metabase user sessions: Access the Metabase application database and delete all rows from the `core_session` table.
• ✓Review API keys and delete any unrecognized keys.
• ✓Check for suspicious changes to administrator accounts.
• ✓Change credentials for all connected databases.
• ✓Review data warehouse logs for any signs of unauthorized access.
• ✓Check Metabase activity and query history for any suspicious entries.

Attack patterns have been reported to show calls to POST /api/session/reset_password with a 400 status code, followed by calls to GET /api/user/current with a 200 status code. It is crucial to check for these log patterns.

Reference Sources and Official Patch Information