CVE-2026-72898: 
NixOS vulnerability analysis and mitigation

CVE-2026-72898 is a critical SQL injection vulnerability in Metabase that allows a remote, unauthenticated attacker to inject arbitrary SQL via the /api/session/reset_password endpoint and gain full administrator access to the connected Metabase instance. Published on August 10, 2026, it affects Metabase versions x.58.0–x.58.23, x.59.0–x.59.20, x.60.0–x.60.16, x.61.0–x.61.10, x.62.0–x.62.8, and x.63.0–x.63.3. Metabase has confirmed active exploitation in the wild. It carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 10.0 (Critical) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — SQL Injection), rooted in insufficient input sanitization on the unauthenticated /api/session/reset_password endpoint (GitHub Advisory). An attacker can craft a malicious HTTP request to this endpoint, injecting arbitrary SQL directly into the Metabase application database without any authentication or user interaction required. Successful injection allows the attacker to manipulate the database to elevate their privileges to administrator level. The attack is network-accessible, requires low complexity, and is fully automatable, as confirmed by NVD SSVC analysis (Feedly). A technical write-up and exploit walkthrough have been published publicly (1dayexploit Blog, Wiz Blog).

Successful exploitation grants an unauthenticated attacker full administrator access to the Metabase instance, enabling them to alter application configuration, steal stored credentials for all connected databases, read or export any data accessible through those database connections, and disrupt availability (GitHub Advisory). The scope change (S:C in CVSS) reflects that compromise extends beyond Metabase itself to all connected data warehouses and downstream systems. This creates significant risk of lateral movement, mass data exfiltration, and supply chain exposure for organizations using Metabase as a central analytics platform (Feedly).

Metabase has confirmed active exploitation of CVE-2026-72898 in the wild (GitHub Advisory). The vulnerability is fully automatable with no authentication or user interaction required, and NVD SSVC classifies exploitation as "active" (Feedly). A public exploit write-up has been published (1dayexploit Blog), and a CISA CSAF advisory file has been issued (va-26-222-01) (EUVD). The EPSS score is currently 0.0 (newly published), but given confirmed active exploitation and public PoC availability, real-world risk is extremely high. No specific threat actor attribution has been publicly reported at this time.

1. Reconnaissance: Identify internet-facing Metabase instances using tools like Shodan or Censys, filtering for affected versions (x.58.0–x.58.23, x.59.0–x.59.20, x.60.0–x.60.16, x.61.0–x.61.10, x.62.0–x.62.8, x.63.0–x.63.3).
2. Identify the vulnerable endpoint: Confirm the /api/session/reset_password endpoint is accessible without authentication by sending a baseline HTTP POST request to the target.
3. Craft SQL injection payload: Construct a malicious HTTP POST request to /api/session/reset_password containing an SQL injection payload in the relevant parameter, designed to manipulate the Metabase application database (e.g., modifying user records or session tokens to grant admin privileges).
4. Inject and escalate: Submit the crafted request; the injected SQL executes against the Metabase application database, elevating the attacker's account or creating a new administrator account.
5. Achieve full access: Log in to the Metabase instance with administrator credentials, access connected database credentials, query or export sensitive data, modify application configuration, or pivot to connected data warehouses (GitHub Advisory, Wiz Blog, 1dayexploit Blog).

• Network: Unusual or repeated HTTP POST requests to /api/session/reset_password from unexpected or external IP addresses; outbound connections from the Metabase server to unknown external hosts following such requests.
• Logs: Metabase application logs showing SQL errors or anomalous query patterns originating from the /api/session/reset_password endpoint; unexpected administrator login events from unfamiliar IP addresses or at unusual times.
• Application State: Unexpected new administrator accounts or modifications to existing admin accounts in the Metabase user table; unrecognized API keys present in the Metabase admin panel; unexpected changes to application configuration.
• Database: Unauthorized or anomalous queries in connected data warehouse logs; unexpected bulk data exports or queries accessing sensitive tables.
• Session: Presence of unrecognized active sessions in the core_session table of the Metabase application database (GitHub Advisory).

Metabase has released patched versions for all affected branches: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5 — upgrading immediately is the strongly recommended action (GitHub Advisory). As a temporary workaround for those unable to upgrade immediately, block access to the /api/session/reset_password endpoint at the network or reverse proxy level. After upgrading, Metabase advises: (1) revoke all active user sessions by deleting all rows in the core_session table, (2) review and delete any unrecognized API keys, (3) review administrator accounts for unexpected changes, (4) rotate credentials for all connected databases, and (5) review data warehouse logs and Metabase query history for signs of unauthorized access (GitHub Advisory, Metabase Blog).

Wiz published a technical blog post analyzing the vulnerability and its in-the-wild exploitation shortly after disclosure (Wiz Blog). Security researcher Will Dormann (@wdormann) commented on the vulnerability via Mastodon and Bluesky, drawing community attention to its severity and exploitability (Mastodon). FOFA Bot also highlighted the vulnerability on social media, indicating active scanning interest from the threat intelligence community (xcancel). The vulnerability received rapid coverage across multiple vulnerability tracking platforms (VulnDB, Vulners, kevintel) within hours of disclosure, reflecting the high community concern given its critical score and confirmed active exploitation.