Metabase SQL Injection Vulnerability (CVE‑2026‑72898): Impact, Affected Versions, and Mitigation

by

Overview

JPCERT/CC issued an advisory (JPCERT‑AT‑2026‑0023) on 14 August 2026 reporting an unauthenticated SQL injection vulnerability in Metabase, assigned CVE‑2026‑72898. If exploited, a remote attacker can send crafted requests to the /api/session/reset_password endpoint, execute arbitrary SQL against Metabase’s application database, and obtain administrator privileges.

Vendor Confirmation

Vendor claim: Metabase confirmed that the vulnerability is being actively exploited in the wild, including a zero‑day attack observed on 2 August 2026, and that proof‑of‑concept code is publicly available.

Affected Versions

  • Metabase 63.x: versions earlier than 63.5
  • Metabase 62.x: versions earlier than 62.9
  • Metabase 61.x: versions earlier than 61.11
  • Metabase 60.x: versions earlier than 60.17
  • Metabase 59.x: versions earlier than 59.21
  • Metabase 58.x: versions earlier than 58.24

Versions prior to the 58 series are not affected, and Metabase Cloud instances have already applied the fix.

Mitigation

Metabase advises upgrading to the latest release that includes the fix. The official security advisory and blog post provide the necessary update instructions.

Temporary Work‑around

If an immediate upgrade is not possible, block network access to the vulnerable endpoint:

/api/session/reset_password

Detection Indicators

JPCERT notes that the following request pattern is a strong indicator of compromise:

  • POST to /api/session/reset_password returning HTTP 400
  • Subsequent GET to /api/user/current returning HTTP 200

When these logs appear, investigate for possible breach, rotate database credentials, and invalidate user sessions and API keys.

References