Metabase Unauthenticated SQL Injection via Password Reset (CVE-2026-72898)

The CVE record says Metabase lets a remote, unauthenticated attacker inject arbitrary SQL through the "/reset_password" database endpoint and gain administrator access. CISA, the CVE numbering authority, rates it CVSS 10.0 Critical. Metabase's own advisory says the company "has confirmed active exploitation of this vulnerability."

Metabase is a business intelligence tool. It stores its settings, users and saved connections in an application database, and it holds credentials for the data sources it queries. That makes the application database a high value target.

What the Attacker Reaches

Metabase and CISA describe the same chain. The injected SQL runs against the application database and can lead to administrator access. From there an attacker could change the application configuration, steal stored credentials for connected databases, read data reachable through those connections, and export it.

The advisory and Metabase's notice name the endpoint as /api/session/reset_password. Metabase says its own Cloud service was attacked, that it blocked the endpoints used in the attack, and that Cloud instances are already patched.

What Metabase Says to Look For in Logs

Metabase's notice gives one pattern that suggests compromise. A POST request to /api/session/reset_password that returns 400 is followed by a GET request to /api/user/current that returns 200. We recommend searching reverse proxy and application logs for that pair, going back to at least 6 August 2026, the date of the advisory.

If the endpoint was reachable from the internet, Metabase lists steps to run after the upgrade. Delete all rows in the core_session table to revoke sessions, remove API keys you do not recognise, and review administrator accounts. Then rotate the credentials of every connected database, and review data warehouse logs and Metabase activity history.

Exploitation Signals for CVE-2026-72898

These are the public signals we checked on 4 November 2026. Each row names its source and date.

The repository descriptions are the authors' own claims, and we did not run any code. The earliest repository was created on 12 August 2026, the day after the KEV listing.

The same class of bug appears in other products. See our email gateway SQL injection analysis and the SQL injection glossary entry for how this flaw type works. The zero-day vulnerability glossary entry explains the term Metabase uses for this bug. A similar wave hit another open-source BI tool this year; see the six-CVE Chartbrew bundle and its patch order.

The CVE record and NVD list six affected release lines, each fixed by a point release. The advisory lists the same lines with affected ranges that end one release earlier, so we treat the fixed version as the target.

The CVE record writes versions as x.58.24 and sets the default status to unknown. NVD maps the same ranges to open source versions in the 0.58 to 0.63 lines and to Enterprise Edition versions in the 1.58 to 1.63 lines. The advisory says both open source and Enterprise Edition builds are patched.

Metabase tells readers to upgrade to the latest point release of their line, for example from 0.58.6 to 0.58.24 or later. Metabase says versions below 58 are not vulnerable.

Metabase's workaround is to block the /api/session/reset_password endpoint until the upgrade is done. Metabase Cloud customers are already patched, according to Metabase. Our vulnerability management guide covers how to plan and verify a rollout, and the known exploited vulnerabilities entry explains the KEV catalogue.