Metabase SQL injection via password reset endpoint (CVE-2026-72898)

What is affected, what to do

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

The vulnerability is being actively exploited; treat it as a priority. Update metabase to version 1.59.21, Metabase to version x.61.11. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Metabase gte x.58.0..*
• Metabase gte x.59.0..*
• Metabase gte x.60.0..*
• Metabase gte x.61.0..*
• Metabase gte x.62.0..*
• Metabase gte x.63.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade Metabase immediately to a fixed release: 0.58.25 / 0.59.22 / 0.60.18 / 0.61.12 / 0.62.10 / 0.63.6, or Enterprise 1.58.25 / 1.59.22 and the corresponding higher branches. For container deployments, re-pull the official metabase/metabase image and redeploy.
   • If a patch window is not reachable within hours, take the Metabase web UI off the public internet (close the ingress on reverse proxy, load balancer or cloud security group) and expose it only via VPN or a Zero-Trust proxy. The /api/session/reset_password endpoint must be blocked explicitly.
   • Audit Metabase admin accounts: disable any unknown or newly created admin users and invalidate active sessions (DELETE FROM core_session; in the application DB, coordinated with the app owner).
   • Treat every database credential stored inside Metabase as compromised and rotate them (Snowflake, Postgres, MySQL, BigQuery, Redshift service accounts, etc.). For cloud IAM roles, rotate access keys and audit recent key usage.
   • Rotate the encryption secret (MB_ENCRYPTION_SECRET_KEY) and inspect the Metabase application database for suspicious rows in core_user, permissions_group_membership and setting.
   • Open an incident ticket; if personal data was reachable through any attached data source, assess GDPR / NIS2 reporting duties (72-hour clock).
2. 02

   Runbook step 2

   Mitigation layers

   • Network: add a WAF or reverse-proxy rule that blocks requests to /api/session/reset_password containing SQL metacharacters (', --, ;, /*, UNION, SELECT). Apply a strict rate limit on all /api/session/* endpoints.
   • Perimeter: Metabase does not belong on the public internet. Enforce ingress rules "VPN CIDR + office NAT only". For broader access, front it with a reverse proxy that performs pre-auth OIDC (oauth2-proxy, Authentik, Entra ID Application Proxy).
   • Harden the application DB: avoid the embedded H2 database, use Postgres or MySQL, and give the Metabase DB user minimal rights — no superuser, no CREATE EXTENSION, no access to other schemas.
   • Least privilege on data sources: connection users configured in Metabase must only have SELECT on the required views/schemas, no COPY, no file-system functions (pg_read_server_files et al.), no write privileges. This caps blast radius even if an admin account is seized.
   • Egress filtering: restrict outbound traffic from Metabase hosts to known destinations (databases, SMTP, update servers). This blocks exfiltration and reverse shells.
   • Monitor the application DB: add triggers or an audit log on changes to core_user and permissions_group so that any newly created admin surfaces immediately.
3. 03

   Runbook step 3

   Detection rules

   • Web / reverse-proxy logs: POSTs to /api/session/reset_password with unusually large bodies, SQL keywords or base64 blobs. Sigma shape: selection: cs-uri-stem endswith '/reset_password' AND cs-method: 'POST' AND (cs-body contains 'UNION' OR contains '--' OR contains 'pg_sleep').
   • Metabase application log (metabase.log / stdout): stack traces containing JdbcSQLSyntaxErrorException, PSQLException or metabase.api.session co-occurring with reset_password indicate injection attempts.
   • Application-DB audit: unexpected INSERT/UPDATE on core_user, especially with is_superuser = true, or UPDATE on setting (site URL, SMTP, SSO config). KQL example: DBAudit | where TableName in ('core_user','setting') and Operation in ('INSERT','UPDATE') and SourceApp == 'metabase'.
   • EDR / process telemetry on the Metabase host: the Java process (java … metabase.jar) spawning sh, bash, curl, wget, nc or python never happens in normal operation. Trigger Sysmon EID 1 where ParentImage endswith java.exe/java.
   • Network: unusual outbound connections from the Metabase host to non-whitelisted IPs/ports (Zeek conn.log with orig_h = metabase_ip AND resp_h !in known_destinations). Large HTTPS or DNS exports to cloud storage providers indicate data exfiltration.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Source: BSI WID Portal, BSI CSAF, pwn.watch, cvelistv5, CISA KEV Catalog, NVD (NIST)

Vendors and products

• Metabase Metabase

Weakness classes (CWE)

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  Base

  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

  Entry at MITRE CWE-89

References & sources

• github.comurlVendor advisory
• metabase.comurlVendor advisory, pwn-watch
• CVE.org (MITRE)urlVulnerability database
• raw.githubusercontent.comurlThird-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898government-resource
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2026-ALE-010 – Vulnérabilité dans Metabase (clôturée 2026-10-13)cert-fr
• pwn.watchpwn.watch: Metabase Metabase: Metabase SQL Injection Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-72898pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
• JPCERT/CCJPCERT/CC JPCERT-AT-2026-0030: 直近で相次いでいる国内組織における不正アクセスに関する注意喚起jpcert

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 11.08.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-08-11
   Due Date	added	—	2026-08-11
   Required Action	added	—	2026-08-11
   Vulnerability Name	added	—	2026-08-11

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

2. 11.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898
   SSVC assessment	changed	{"id":"CVE-2026-72898","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-11T03:55:38.093614Z"}	{"id":"CVE-2026-72898","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-11T19:40:18.171227Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 11.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-72898","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-10T00:00:00+00:00"}	{"id":"CVE-2026-72898","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-11T03:55:38.093614Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 11.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-72898","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-10T20:02:34.747669Z"}	{"id":"CVE-2026-72898","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-10T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 10.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	added	—	{"id":"CVE-2026-72898","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-10T20:02:34.747669Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32SANS @RISK20.08.2026
• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31SANS @RISK13.08.2026