Metabase SQLi Zero-Day (CVE-2026-72898) Exploited

Executive Summary

A critical, unauthenticated SQL injection zero-day vulnerability, tracked as CVE-2026-72898, is being actively exploited in the popular open-source business intelligence platform Metabase. The vulnerability, which has a CVSS score of 10.0, affects Metabase versions 1.58 and later. It allows a remote, unauthenticated attacker to gain full administrator privileges on a vulnerable instance. Several organizations, including laptop manufacturer Framework, have already confirmed data breaches resulting from the exploitation of this flaw. Metabase has released patches and is urging all self-hosted customers to upgrade immediately or apply mitigations to prevent compromise.

Vulnerability Details

The vulnerability is an unauthenticated SQL injection flaw located in the /api/session/reset_password API endpoint. An attacker can send a specially crafted POST request to this endpoint, injecting malicious SQL commands into the backend Metabase application database. Successful exploitation allows the attacker to effectively reset the password of an existing user, typically targeting an administrator account, and take it over.

Once an attacker has administrator access to the Metabase instance, they have complete control. They can:

• Change any configuration settings.
• View, modify, or exfiltrate credentials for all connected databases.
• Query and exfiltrate any data that the Metabase instance has access to.
• Create new administrative users for persistence.

This vulnerability is particularly dangerous because Metabase is designed to be a central hub for connecting to and visualizing data from numerous sensitive sources like production databases, data warehouses, and application backends.

Affected Systems

• Product: Metabase (self-hosted instances)
• Affected Versions: 1.58.0 and later versions prior to patching.
• Patched Versions: Metabase has released patched versions and all users are urged to upgrade. Check the official Metabase security blog for the latest patched version numbers.

Metabase Cloud instances were automatically patched by the vendor and are not vulnerable.

Exploitation Status

The vulnerability is confirmed to be actively exploited in the wild as a zero-day. Metabase themselves discovered the flaw after their own cloud infrastructure was targeted. Since the public disclosure on August 6, 2026, exploitation has become more widespread. Several companies have publicly disclosed that they were victims of attacks leveraging this vulnerability, including:

• Framework: Laptop manufacturer confirmed a breach of customer PII.
• Tally: Form builder company reported an incident.
• LexisNexis: Reported an incident related to the flaw.

Impact Assessment

The impact of exploiting CVE-2026-72898 is catastrophic for affected organizations, justifying its CVSS 10.0 score. Gaining administrator access to Metabase is equivalent to handing over the keys to an organization's most critical data assets. The primary impact is widespread data breach, as seen in the Framework incident where customer PII (names, emails, phone numbers, addresses) was stolen. Attackers can pivot from the compromised Metabase instance to attack the underlying connected databases, potentially leading to further system compromise, data destruction, or ransomware deployment. The reputational damage and potential regulatory fines resulting from such a breach are significant.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Metabase provided a specific log pattern to identify compromise attempts:

1. A POST request to /api/session/reset_password that returns a 400 status code.
2. Immediately followed by a GET request to /api/user/current that returns a 200 status code.

This sequence indicates an attacker successfully used the exploit to gain a session token and then verified their access.

Detection Methods

Log Analysis (D3-NTA): The most effective detection method is to analyze Metabase and web server access logs for the specific pattern described above. Create a SIEM alert that triggers when a POST to /api/session/reset_password with a 400 status is followed within a short time window by a GET to /api/user/current with a 200 status from the same source IP.

# Example Sigma Rule Logic
title: Metabase SQLi Zero-Day CVE-2026-72898 Exploitation
status: experimental
logsource:
  category: webserver
detection:
  selection_attempt:
    cs-method: POST
    c-uri: '/api/session/reset_password'
    sc-status: 400
  selection_success_check:
    cs-method: GET
    c-uri: '/api/user/current'
    sc-status: 200
  timeframe: 10s
  condition: selection_attempt and selection_success_check | near(selection_attempt.source_ip == selection_success_check.source_ip)

Network Monitoring: Monitor network traffic for connections to the /api/session/reset_password endpoint. While legitimate password resets will use this, a high volume of requests or requests from known malicious IPs should be investigated.

Remediation Steps

1. Upgrade Immediately (D3-SU): The primary remediation is to upgrade your self-hosted Metabase instance to a patched version as specified in the official Metabase security advisory.
2. Temporary Mitigation: If you cannot upgrade immediately, block all external access to the /api/session/reset_password endpoint at your firewall or web application firewall (WAF). This will prevent exploitation but will also break the legitimate password reset functionality.
3. Assume Compromise: If you find evidence of exploitation, assume all secrets and credentials stored in or accessible by Metabase have been compromised. This includes database credentials, API keys, etc.
4. Incident Response: If compromised, immediately rotate all database credentials, API keys, and other secrets connected to Metabase. Force a password reset for all Metabase users and review audit logs for any unauthorized activity.