CVE-2026-72898: Metabase Unauthenticated SQL Injection to Admin Takeover (KEV)

CVE-2026-72898 is an unauthenticated SQL injection in Metabase's password-reset endpoint that an attacker can use to gain administrator access and then steal connected-database credentials, and Metabase itself has confirmed active exploitation of this vulnerability, including against its own Metabase Cloud environment.

CVE-2026-72898 is a SQL Injection (CWE-89) in Metabase, the open-source business-intelligence and data-visualization tool. NVD's Analyzed description states that Metabase "allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance" (NVD).

NVD's vulnStatus for this record is Analyzed, but NVD has not published its own independent Primary CVSS score; the only metrics on record are the CNA-submitted Secondary ratings of CVSS v3.1 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 10.0 — both the maximum possible score. So the 10.0 shown here is the reporting CNA's Secondary score, not an NVD-confirmed Primary score (NVD).

Metabase's own security-update blog post (2026-08-06) explains that the vulnerable /api/session/reset_password endpoint lets an attacker "inject arbitrary SQL against the Metabase application database, which can give them administrator access," from which they can change application configuration, steal credentials for every connected database, read any data reachable through those connections, and export it. The post states Metabase's own Metabase Cloud environment experienced an active attack using this exact flaw, prompting emergency patching and endpoint blocking, and recommends blocking the /api/session/reset_password endpoint at the network or proxy layer as a temporary measure for self-hosted instances that cannot upgrade immediately to the fixed releases 0.58.24-0.63.5 / 1.58.24-1.63.5 (Metabase security update). GitHub's companion advisory GHSA-vwf4-m7j8-wcjf confirms the same CVE ID, affected version ranges and "confirmed active exploitation of this vulnerability" language (GitHub Advisory GHSA-vwf4-m7j8-wcjf).

CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-11, with a required-action due date of 2026-08-14, though the catalog does not record known ransomware campaign use (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at an unusually high 0.9855 (99.922th percentile), consistent with the vendor's own account of ongoing, confirmed real-world exploitation (FIRST EPSS).

Any self-hosted Metabase instance on an affected version should be upgraded to the fixed release immediately, or have the /api/session/reset_password endpoint blocked at the network edge in the meantime, and database credentials rotated if compromise cannot be ruled out.

• Unauthenticated SQL injection via Metabase's '/reset_password' database endpoint allows an attacker to gain administrator access to the connected Metabase instance. — NVD
• CVSS v3.1 base score is 10.0 and v4.0 is 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — the reporting CNA's Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Vulnerable endpoint is /api/session/reset_password; Metabase confirms active exploitation including an attack on its own Metabase Cloud environment; fixed in 0.58.24-0.63.5 / 1.58.24-1.63.5; temporary workaround is blocking the endpoint. — Metabase security update
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-11, required-action due date 2026-08-14. — CISA KEV
• EPSS score is 0.9855 (99.922th percentile) as of 2026-10-27. — FIRST EPSS