CVE-2026-72898: Metabase SQL Injection Vulnerability
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
Overview
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Vulnerability details
CVE-2026-72898 is a SQL injection flaw (CWE-89) in Metabase's password reset flow. The `/api/session/reset_password` endpoint accepts user-supplied input without proper sanitization or parameterization before incorporating it into SQL queries against the Metabase application database. Because this endpoint is part of the unauthenticated password reset flow, no credentials are required to reach it. Any Metabase instance with this endpoint network-accessible is exposed, regardless of whether the instance has active users or configured authentication policies.
An attacker sends a crafted HTTP request to the `/api/session/reset_password` endpoint containing an arbitrary SQL payload in attacker-controlled input fields. The unsanitized input is executed against the Metabase application database, allowing the attacker to escalate privileges to administrator level. With administrator access, the attacker can alter application configuration, extract stored credentials for all connected databases, read any data accessible through those database connections, and export data. Metabase has confirmed active exploitation of this vulnerability in the wild.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review web access logs for POST requests to `/api/session/reset_password` originating from IP addresses with no prior authenticated session history, particularly at high volume or from unexpected geographic sources, which distinguishes exploitation attempts from legitimate password resets.
- Audit the Metabase application database `core_session` table for unexpected administrator sessions created without a corresponding prior login event, and review the administrator account list for unrecognized accounts or privilege changes, as the vendor advisory identifies these as post-exploitation indicators.
- Inspect connected data warehouse query logs for anomalous queries issued under Metabase service credentials outside normal business hours or accessing tables inconsistent with configured Metabase questions and dashboards, indicating post-compromise data access through stolen database credentials.
Remediation
Additional hardening
- Upgrade Metabase to x.58.24 or later for the x.58 release line, x.59.21 or later for x.59, x.60.17 or later for x.60, or x.61.11 or later for x.61. See the vendor advisory in References for additional fixed builds across other release lines.
- If immediate upgrade is not possible, block the `/api/session/reset_password` endpoint at the network perimeter or reverse proxy as a temporary compensating control, preventing unauthenticated access to the vulnerable code path.
- After patching, revoke all active sessions by deleting all rows in the `core_session` table, rotate credentials for every connected database, and delete any unrecognized API keys, as the vendor advisory identifies these steps as mandatory post-exploitation triage.
- Restrict network access to the Metabase instance so the application is not directly reachable from the public internet; place it behind a VPN or internal network boundary to reduce the attack surface for this and future unauthenticated endpoint vulnerabilities.
Key dates
References
- https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
- https://www.metabase.com/blog/security-update
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-72898
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-72898
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898
Frequently asked questions
Does CVE-2026-72898 affect my FedRAMP authorization?
If Metabase Metabase runs inside your authorization boundary, CVE-2026-72898 is a direct concern for your FedRAMP authorization. CISA has listed this vulnerability in its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of August 14, 2026. An unpatched KEV inside your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it.
How does Knox help me handle CVE-2026-72898?
Knox does not patch Metabase Metabase on your behalf. Under the FedRAMP shared-responsibility model, remediating this vulnerability is your obligation. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that remediation, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours; managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-72898. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal problem.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-72898 isn't remediated by August 14, 2026?
Missing the August 14, 2026 deadline turns CVE-2026-72898 into a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what converts a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Remediating on time keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
