CVE-2026-72898: 
NixOS vulnerability analysis and mitigation

CVE-2026-72898 is a critical SQL injection vulnerability in Metabase — an open-source business intelligence platform — that allows a remote, unauthenticated attacker to inject arbitrary SQL via the /api/session/reset_password endpoint and gain full administrator access to the connected Metabase instance. It was published on August 10, 2026, and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 11, 2026, with a remediation deadline of August 14, 2026. Affected versions span the x.58.0–x.63.x range across both open-source and enterprise editions. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 10.0 (Critical) (GitHub Advisory, CISA KEV).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — SQL Injection). The /api/session/reset_password endpoint, which is intended for unauthenticated password reset flows, fails to properly sanitize user-supplied input before incorporating it into SQL queries against the Metabase application database. An attacker can craft a malicious HTTP request to this endpoint containing SQL injection payloads that manipulate the underlying query to escalate privileges and obtain administrator access — requiring no prior authentication, no user interaction, and no special network position. Technical write-ups have been published by Bishop Fox, Wiz, and Horizon3.ai, and a Nuclei detection template was added to the ProjectDiscovery repository (GitHub Advisory, Wiz Blog, CISA KEV).

Successful exploitation grants an unauthenticated attacker full administrator access to the Metabase instance, enabling them to read and modify all data, alter application configuration, steal stored credentials for all connected databases, and export sensitive business intelligence data. The scope change (CVSS S:C) reflects that compromise extends beyond Metabase itself to all downstream databases and data sources connected to the instance. Real-world exploitation has been confirmed in multiple organizations, including a breach of Trezor's shipping partner (ShipMonk) that exposed data of approximately 13,689 customers, and at least five other companies reported as breached via this vector (GitHub Advisory, Wiz Blog, Meterpreter).

CVE-2026-72898 is actively exploited in the wild and was added to the CISA KEV catalog on August 11, 2026, with a mandatory remediation deadline of August 14, 2026 for federal agencies (CISA KEV). Metabase itself confirmed active exploitation in its security advisory (GitHub Advisory). Multiple GitHub repositories (e.g., 0xBlackash/CVE-2026-72898, codeb0ssx/CVE-2026-72898-PoC, 4minx/CVE-2026-72898) have been published, though at least one was assessed as advisory-only without functional exploit code; additional PoC repositories and a Nuclei detection template are publicly available. The EPSS score is approximately 0.104 (10.4%), and the NVD SSVC assessment classifies exploitation as "active" and the vulnerability as "automatable" with "total" technical impact (Feedly, Wiz Blog).

1. Reconnaissance: Identify internet-facing Metabase instances using tools like Shodan, Censys, or FOFA, filtering for versions in the x.58.0–x.63.x range. The /api/session/reset_password endpoint is publicly accessible by design on unpatched instances.
2. Probe the endpoint: Send an unauthenticated HTTP POST request to /api/session/reset_password on the target Metabase instance to confirm the endpoint is reachable and the instance is unpatched.
3. Inject SQL payload: Craft a malicious request body containing SQL injection strings targeting the password reset query. The injected SQL manipulates the application database query to bypass authentication logic or directly modify user/session records.
4. Escalate to administrator: The injected SQL modifies the Metabase application database to grant the attacker administrator-level access — for example, by updating a user record's role or creating a new admin session token.
5. Post-exploitation: With administrator access, the attacker can: exfiltrate stored database credentials for all connected data sources, read or export all data accessible through those connections, modify application configuration, create persistent backdoor API keys, and pivot to connected databases (GitHub Advisory, Wiz Blog).

• Network: Unusual or high-volume HTTP POST requests to /api/session/reset_password from unexpected source IPs; requests containing SQL metacharacters (', --, UNION, SELECT, OR 1=1) in POST body parameters.
• Logs: Metabase application logs showing repeated or anomalous requests to the reset password endpoint; SQL errors or unexpected query patterns in application database logs; new administrator sessions created without corresponding legitimate user activity.
• File System / Database: Unexpected rows in the core_session table of the Metabase application database; new or modified administrator accounts not created through normal provisioning; unrecognized API keys in the Metabase admin panel.
• Process / Behavior: Unusual outbound connections from the Metabase server to external IPs; unexpected data exports or large query executions in Metabase query history; configuration changes (e.g., SMTP, database connections) made outside of normal change windows (GitHub Advisory, CISA KEV).

Immediate action: Upgrade Metabase to a patched version as soon as possible. Fixed versions are: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 (open-source) and 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, 1.63.5 (enterprise) (GitHub Advisory, Metabase Blog). Temporary workaround: If immediate patching is not possible, block access to the /api/session/reset_password endpoint at the network or WAF level. Post-upgrade remediation (if the endpoint was publicly accessible): revoke all active sessions by deleting all rows in the core_session table; review and delete unrecognized API keys; audit administrator accounts for unauthorized changes; rotate credentials for all connected databases; and review data warehouse and Metabase query logs for signs of unauthorized access (GitHub Advisory, CISA KEV).

Metabase confirmed active exploitation in its official security advisory and urged immediate upgrades (GitHub Advisory). CISA added the vulnerability to its KEV catalog with an unusually short 3-day remediation deadline (August 11–14, 2026), signaling high urgency (CISA KEV). Wiz published a detailed in-the-wild exploitation analysis, and Bishop Fox, Horizon3.ai, runZero, and Upwind all released technical coverage within days of disclosure. The Shadowserver Foundation reported scanning activity on social media, and the vulnerability received broad coverage from CSO Online, Security Affairs, GBHackers, and SC World. The Trezor/ShipMonk breach linked to this CVE generated significant attention in the cryptocurrency community, with CryptoSlate and The Street reporting on the downstream impact to approximately 250,000 crypto users (Wiz Blog, Meterpreter, CryptoSlate).