CVE-2026-72898 | ArxDecoded

Metabase SQL Injection Vulnerability (CVE‑2026‑72898): Impact, Affected Versions, and Mitigation

August 25, 2026

JPCERT‑AT warns that Metabase versions prior to specific releases contain an unauthenticated SQL injection (CVE‑2026‑72898) that can grant admin access. Learn which versions are affected, how attackers exploit it, and what immediate steps you should take.