Metabase Zero-Day (CVE-2026-72898): CVSS 10.0 SQL Injection Exploited in the Wild

A maximum-severity flaw in the open-source BI tool Metabase, tracked as CVE-2026-72898, lets an unauthenticated attacker inject SQL through the password-reset endpoint and take over the instance as an administrator. It carries a CVSS score of 10.0, it was exploited as a zero-day before a patch existed, and CISA has already added it to its Known Exploited Vulnerabilities catalog. If you run Metabase, the only safe assumption is that internet-facing instances were probed the moment the exploit went public: patch to a fixed release or block the endpoint today.

This is not a theoretical bug. Metabase confirmed the flaw was used in real attacks, and at least three companies — hardware maker Framework, form builder Tally, and workflow-automation platform n8n — have disclosed customer-data theft tied to it. Here is what the vulnerability does, who it has hit, and the exact steps to close it.

What is CVE-2026-72898?

CVE-2026-72898 is an unauthenticated SQL injection in Metabase that leads to full administrator takeover. The weakness sits in the /api/session/reset_password endpoint, which is reachable without logging in. According to Metabase's security advisory, "the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance." Because the endpoint needs no credentials, an attacker only needs network access to a vulnerable instance — no stolen password, no user interaction.

Once inside as an admin, the damage is not limited to Metabase itself. Metabase is a business-intelligence layer that holds saved connections to your production databases and data warehouses. An attacker with admin rights can change application settings, read stored connection credentials, query everything those connections can reach, and export the results. That is why researchers at Horizon3.ai and others have flagged the blast radius as far larger than a single dashboard tool — it is a pivot straight into whatever data Metabase was configured to see. The NVD entry for CVE-2026-72898 rates it 10.0, the top of the scale.

Which Metabase versions are affected?

Everything from the 1.58 branch forward was vulnerable until the August patches. Versions below 58 are not affected. Metabase shipped fixed builds on August 6, 2026, one per supported branch — upgrade to the matching release or later.

Branch	Vulnerable	Fixed release (OSS / Enterprise)
63	0.63.0 – 0.63.4	0.63.5 / 1.63.5
62	0.62.0 – 0.62.8	0.62.9 / 1.62.9
61	0.61.0 – 0.61.10	0.61.11 / 1.61.11
60	0.60.0 – 0.60.16	0.60.17 / 1.60.17
59	0.59.0 – 0.59.20	0.59.21 / 1.59.21
58	0.58.0 – 0.58.23	0.58.24 / 1.58.24
< 58	Not vulnerable	—

The open-source (0.x) and Enterprise (1.x) builds share version numbers, so 0.63.5 and 1.63.5 are the same fix on different editions. If you cannot upgrade immediately, Metabase's documented workaround is to block the /api/session/reset_password endpoint at your reverse proxy or firewall until you can patch.

Who has been hit so far

The attacks landed in the first days of August 2026, before most operators knew a flaw existed — the hallmark of a true zero-day. Several companies have since come forward:

• Framework told customers that attackers stole personal data including full names, email addresses, login IP addresses, and billing and shipping addresses; business customers also had VAT, EIN, and billing-email fields exposed. Framework said it was notified by Metabase on August 6, with the intrusion dated August 3, per BleepingComputer's reporting.
• Tally, the form builder, disclosed that attackers reached user email addresses and password hashes (stored as one-way cryptographic hashes), while form content and submissions were not accessed.
• n8n, the workflow-automation platform, said an attacker obtained 136 customer records, according to reporting from The Hacker News.

The common thread is that none of these were Metabase's fault as a product misconfiguration — they were running a supported version that happened to be exploitable, and the reset-password endpoint was reachable.

How to tell if your instance was compromised

Patching stops future exploitation; it does not undo a breach that already happened. Check your logs for the exploitation pattern first. The public indicator is a POST request to /api/session/reset_password that returns HTTP 400, followed shortly by a GET to /api/user/current returning 200 — the sequence of a failed-looking injection that nonetheless minted an admin session. Runzero, Horizon3, and other trackers have published matching detection guidance for finding impacted assets.

If you find that pattern, or you simply cannot rule it out, Metabase's post-upgrade remediation is to revoke every active session by clearing the core_session table, delete any API keys you do not recognize, audit admin accounts for unexpected changes, rotate the credentials for every connected database, and review your data-warehouse and Metabase query logs for unauthorized access. Rotating the downstream database credentials is the step people skip and the one that matters most, because those stored connection secrets are exactly what an admin-level attacker goes after.

Why a BI tool is the perfect pivot point

Most breach coverage frames CVE-2026-72898 as "another critical CVE, patch it." The more useful lesson is about where the tool sits. Analytics and BI platforms are given broad, standing read access to the most sensitive data an organization has — customer tables, revenue, PII — and they are frequently self-hosted, exposed to the internet for remote teams, and then forgotten about at patch time. That combination makes them a higher-value target than the dashboard framing suggests: compromise the BI layer and you inherit its view of everything behind it.

The defensive takeaways generalize beyond Metabase. Keep internal tooling off the public internet where you can, putting it behind a VPN or a zero-trust proxy rather than a raw open port (the same logic in our zero-trust vs VPN breakdown). Treat any self-hosted app with database access as part of your attack surface and patch it on the same urgency as your edge — the Kemp LoadMaster pre-auth RCE earlier this year made the same point. And harden the host itself so a single app compromise does not become a full server takeover, as covered in our secure-first-hour VPS setup.

FAQ

What is CVE-2026-72898? It is a CVSS 10.0 unauthenticated SQL injection in Metabase's /api/session/reset_password endpoint. An attacker with network access can inject SQL and gain administrator access to the instance without any credentials, then read stored database connection secrets and exfiltrate connected data.

Which Metabase versions need patching? Any release from 1.58/0.58 up to the August fixes. Upgrade to 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (or the matching Enterprise 1.x build) for your branch. Versions below 58 are not vulnerable.

Is CVE-2026-72898 being actively exploited? Yes. Metabase confirmed exploitation as a zero-day, CISA added it to the Known Exploited Vulnerabilities catalog on August 11, 2026 with a federal remediation deadline of August 14, and multiple companies have disclosed data theft.

I can't upgrade right now. What can I do? Block the /api/session/reset_password endpoint at your reverse proxy or firewall as a temporary mitigation, then patch as soon as possible. This is Metabase's own recommended workaround.

How do I know if my Metabase was breached? Look for a POST to /api/session/reset_password returning HTTP 400 followed by a GET to /api/user/current returning 200. If you see it, revoke sessions, rotate all connected database credentials, delete unknown API keys, and audit admin accounts.

Sources

• Metabase — Security update (official advisory): affected and fixed versions, endpoint mitigation, and post-upgrade remediation steps.
• NVD — CVE-2026-72898: the CVSS 10.0 record and technical description.
• The Hacker News — Metabase zero-day exploited in the wild: exploitation timeline, indicators of compromise, and n8n's 136-record disclosure.
• BleepingComputer — Framework, Tally disclose Metabase data-theft attacks: what data was stolen from named victims and disclosure dates.
• Horizon3.ai — CVE-2026-72898 attack research: analysis of the SQL injection and its impact.
• Runzero — Find impacted Metabase assets: detection and asset-inventory guidance.