Metabase SQL Injection Vulnerability
TL;DR 📌
- Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export…
- Highest CVSS: 10.0 (Critical).
- Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-72898.
What it is
CVE-2026-72898 is a SQL injection vulnerability in Metabase. An unauthenticated remote attacker can inject arbitrary SQL into the Metabase application database over the network, with no user interaction required.
Successful exploitation gives the attacker administrator access to the Metabase instance itself. From there, they can change the application’s configuration, retrieve stored credentials for any databases connected to Metabase, read data through those connections, and export it.
The CVSS score is 10.0 (Critical), reflecting the combination of unauthenticated network access, low attack complexity, and full compromise of confidentiality, integrity and availability. The scope change (S:C) in the vector reflects that the impact extends beyond Metabase itself to the connected data sources.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-11. It is known to be exploited.
What to do
- Treat any internet-facing Metabase instance as high priority. Check the advisory at the NVD link for a fixed release, as none is listed yet in the data available here — confirm directly with Metabase before assuming a patch exists.
- Where a fix is available, apply it immediately given the KEV listing and the unauthenticated network attack path.
- If patching isn’t yet possible, restrict network access to the Metabase admin/application interface to trusted management networks only — this instance should not be reachable from the open internet.
- Rotate credentials for any databases connected to Metabase, since stored credentials are a stated impact of this flaw.
- Review Metabase configuration and audit logs for unexpected admin-level changes or unusual query activity, given this is listed as actively exploited.
- Confirm your CISA KEV remediation deadline for this CVE and track it through your standard vulnerability management process.
For leadership 🧭
Executive summary. A remotely exploitable, unauthenticated flaw in Metabase can hand an attacker full admin control of the instance and the credentials for every database it connects to; it is already listed as actively exploited, so this needs attention today, not at the next patch cycle.
Why it matters:
- No authentication or user interaction is needed - anyone who can reach the Metabase application over the network can attempt exploitation.
- Successful exploitation grants administrator access to Metabase itself, not just a single record or query result.
- The scope change in the CVSS vector reflects that impact spreads beyond Metabase to every connected database whose credentials it stores, meaning data exposure isn’t limited to the BI tool.
- This CVE is in CISA’s Known Exploited Vulnerabilities catalogue, so exploitation attempts are already happening rather than being theoretical.
Now / Next / Later:
- Now: Identify every Metabase instance reachable from the internet and, if a patch isn’t immediately confirmed, restrict network access to the admin/application interface to trusted management networks only.
- Next: Apply the vendor’s fixed release as soon as it’s confirmed via the NVD advisory, and rotate credentials for every database connected to Metabase.
- Later: Add Metabase to routine vulnerability management tracking against CISA KEV deadlines, and review its configuration and audit logs periodically for unexpected admin-level changes or unusual query activity.