## https://sploitus.com/exploit?id=7C492E92-0EFE-5F07-BC01-DA140EBDFA70
# 🔴 CVE-2026-72898 - `Unauthenticated SQL Injection`
### Metabase — Unauthenticated SQL Injection → Full Administrator Takeover
---
## 📌 Overview
**CVE-2026-72898** is a **maximum-severity (CVSS 10.0)** unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the application database via the password-reset endpoint.
Successful exploitation grants **full administrator access** to the Metabase instance. From there, an attacker can:
- Modify application configuration
- Steal stored credentials for connected databases
- Read any data accessible through those connections
- Export sensitive data at will
> **This vulnerability was exploited in the wild as a zero-day** against Metabase Cloud and multiple self-hosted customers.
---
## ⚡ Key Details
| Field | Value |
|--------------------------|-----------------------------------------------------------------------|
| **CVE ID** | CVE-2026-72898 |
| **GHSA** | [GHSA-vwf4-m7j8-wcjf](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf) |
| **Severity** | Critical |
| **CVSS v3.1** | `10.0` — `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` |
| **CVSS v4.0** | `10.0` |
| **CWE** | CWE-89 — Improper Neutralization of Special Elements used in an SQL Command |
| **Attack Vector** | Network |
| **Authentication** | None required |
| **User Interaction** | None |
| **Exploitation Status** | **Actively exploited in the wild** (Zero-day) |
| **CISA KEV** | Listed |
---
## 🎯 Affected Endpoint
```
POST /api/session/reset_password
```
An unauthenticated attacker can send a crafted request to this endpoint that results in arbitrary SQL execution against the Metabase application database.
---
## 📦 Affected Versions
| Branch | Affected Versions | Fixed Version |
|------------|----------------------------|---------------|
| **x.58** | ≥ x.58.0 and Versions **below 58** are **not affected**.
---
## 🛠️ Remediation
### 1. Upgrade Immediately (Recommended)
Upgrade to the fixed version corresponding to your major release:
| Version | OSS Docker | OSS JAR | Enterprise |
|---------|-------------------------------------|----------------------------------------------|------------|
| **63** | `metabase/metabase:v0.63.5` | [Download](https://downloads.metabase.com/v0.63.5/metabase.jar) | [v1.63.5](https://downloads.metabase.com/enterprise/v1.63.5/metabase.jar) |
| **62** | `metabase/metabase:v0.62.9` | [Download](https://downloads.metabase.com/v0.62.9/metabase.jar) | [v1.62.9](https://downloads.metabase.com/enterprise/v1.62.9/metabase.jar) |
| **61** | `metabase/metabase:v0.61.11` | [Download](https://downloads.metabase.com/v0.61.11/metabase.jar) | [v1.61.11](https://downloads.metabase.com/enterprise/v1.61.11/metabase.jar) |
| **60** | `metabase/metabase:v0.60.17` | [Download](https://downloads.metabase.com/v0.60.17/metabase.jar) | [v1.60.17](https://downloads.metabase.com/enterprise/v1.60.17/metabase.jar) |
| **59** | `metabase/metabase:v0.59.21` | [Download](https://downloads.metabase.com/v0.59.21/metabase.jar) | [v1.59.21](https://downloads.metabase.com/enterprise/v1.59.21/metabase.jar) |
| **58** | `metabase/metabase:v0.58.24` | [Download](https://downloads.metabase.com/v0.58.24/metabase.jar) | [v1.58.24](https://downloads.metabase.com/enterprise/v1.58.24/metabase.jar) |
### 2. Temporary Workaround
If you cannot upgrade immediately, **block access** to the vulnerable endpoint:
```
/api/session/reset_password
```
---
## 🔍 Detection & Indicators of Compromise
Look for this characteristic attack pattern in your application or ingress logs:
```
POST /api/session/reset_password → 400
GET /api/user/current → 200
```
If this sequence appears, your instance is **likely compromised**.
### Post-Upgrade Actions (Highly Recommended)
After upgrading, perform the following:
1. **Invalidate all sessions**
```sql
TRUNCATE TABLE core_session;
```
2. Review and delete any unrecognized **API keys**
3. Audit **administrator accounts** for unexpected changes
4. **Rotate credentials** for all connected databases
5. Review data warehouse logs for unauthorized access
6. Examine Metabase activity & query history for anomalies
---
## 📚 Official References
- [Metabase Security Advisory (GHSA-vwf4-m7j8-wcjf)](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Metabase Official Blog Post](https://www.metabase.com/blog/security-update)
- [CVE Record](https://vulners.com/cve/CVE-2026-72898)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
---
## ⚠️ Disclaimer
This document is provided for **defensive and informational purposes only**.
Always verify information against official vendor advisories.
Upgrade now. Every unpatched instance remains a high-value target.
```