CVE-2026-72898
Metabase SQL injection via password reset endpoint
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Metabase SQL injection via password reset endpoint
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
- Record
CVE-2026-72898- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-55690
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
- Record
EUVD-2026-55690- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
CISA KEV No score
Metabase SQL Injection Vulnerability
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
- Record
CVE-2026-72898- Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
- Record
CVE-2026-72898- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 0xBlackash/CVE-2026-72898 | 2026-08-12 |
| PoC in GitHub | codeb0ssx/CVE-2026-72898-PoC | 2026-08-13 |
| PoC in GitHub | 4minx/CVE-2026-72898 | 2026-08-15 |
| PoC in GitHub | VuxNx/CVE-2026-72898 | 2026-08-15 |
| PoC in GitHub | ubitquity/Metabase-Setup-Endpoint-SQLi-Fix | 2026-08-15 |
| PoC in GitHub | Franc-Zar/CVE-2026-72898-safe-detection | 2026-08-16 |
| PoC in GitHub | d-maggipinto/CVE-2026-72898-metabase-sqli | 2026-08-26 |
| PoC in GitHub | EQSTLab/CVE-2026-72898 | 2026-08-27 |
| PoC in GitHub | 34zY/CVE-2026-72898 | 2026-09-14 |
| PoC in GitHub | amier-ge/CVE-2026-72898 | 2026-10-04 |
| PoC in GitHub | Riftweld/metabase-cve-2026-72898 | 2026-10-12 |
| PoC in GitHub | gagaltotal/CVE-2026-72898-metabase | 2026-10-13 |
| Nuclei | Metabase - Unauthenticated SQL Injection |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-72898 is a critical vulnerability (CVSS 10.0) in Metabase, published August 10, 2026. CISA lists it as known to be exploited, since August 11, 2026. EUVD reports exploitation since August 11, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.8%, the 99th percentile. No source names a fixed version.