🚨 Critical Vulnerability Alert: Unauthenticated SQL Injection in Metabase (CVE-2026–72898)

In early August 2026, a maximum-severity security flaw tracked as CVE-2026–72898 (GitHub Advisory: GHSA-vwf4-m7j8-wcjf) was publicly disclosed and added to CISA's Known Exploited Vulnerabilities (KEV) catalog as an active zero-day threat. Rated 10.0 (Critical) on the CVSS scale, this vulnerability exposes self-hosted Metabase business intelligence instances to unauthenticated SQL Injection (SQLi) attack vectors.

What Makes This Vulnerability Dangerous?

Metabase acts as a centralized data hub, storing connection strings and credentials for enterprise data warehouses such as Snowflake, BigQuery, AWS Redshift, and PostgreSQL.

The flaw resides directly within Metabase's public password reset API route (POST /api/session/reset_password). Because this endpoint must remain accessible to locked-out users, it operates completely outside session authentication boundaries. Remote attackers can transmit malicious SQL payloads inside request parameters without needing valid credentials, user accounts, or session tokens.

The Impact: Full Platform Takeover

1. Unauthenticated Execution: Attackers execute arbitrary SQL directly against the internal Metabase application database.
2. Admin Escalation: Threat actors mutate internal user records in the core_user table, setting their account's is_superuser flag to TRUE or overwriting an administrator's password hash.
3. Data Exfiltration: Armed with superuser rights, attackers use Metabase's admin REST APIs to decrypt saved credentials and pivot directly into connected production data warehouses.

Immediate Remediation Required

Organizations running self-hosted Metabase deployments must upgrade immediately to fixed maintenance releases (e.g., v0.63.5 / v1.63.5 or higher) across all release streams. If patching is delayed, access to POST /api/session/reset_password should be temporarily blocked at the WAF or reverse-proxy level.

📖 Read the Full Deep-Dive Vulnerability Analysis

For complete technical details, code comparisons (flawed vs. secure query patterns), affected version tables, and threat hunting Indicators of Compromise (IoCs), read the full research article on my blog:

👉 Read the complete analysis at denizhalil.com