CVE-2026-72898

Name of the Vulnerable Software and Affected Versions Metabase versions 0.58.0 through 0.63.4

Description An unauthenticated SQL injection exists in the password-reset flow. A remote attacker can send a crafted HTTP request to the POST /api/session/reset password endpoint containing an undeclared field that is processed as structured input without proper validation. This allows the attacker to inject arbitrary SQL into the application database, leading to full administrative takeover of the Metabase instance. Because Metabase stores connection credentials for connected data warehouses, an attacker with administrator access can extract these credentials to pivot into production data systems. The issue has been actively exploited in the wild against various technology companies, with reports of over 600 compromised databases and attempts to escalate the flaw to remote code execution (RCE). SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database.

Recommendations Update to version 0.63.5 or later. Update to version 0.62.9. Update to version 0.61.11. Update to version 0.60.17. Update to version 0.59.21. Update to version 0.58.24. As a temporary mitigation, block or restrict access to the /api/session/reset password endpoint at the proxy or WAF level. Rotate all connected-database credentials and Metabase secrets after patching. Review access logs, reverse-proxy logs, and audit records for unauthorized administrative accounts or unusual export volumes.