Critical Metabase Zero-Day (CVE-2026-72898): Unauthenticated SQL Injection Grants Admin Access, Exploited in the Wild

Critical Metabase Zero-Day (CVE-2026-72898) (TL-2026-2025), also tracked as GHSA-vwf4-m7j8-wcjf, is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-15. It has no confirmed attribution, affects Metabase Metabase Open Source, references 1 CVE (CVE-2026-72898), maps to 10 MITRE ATT&CK techniques (T1087, T1098, T1136), and is covered by 9 detection rules and 10 indicators of compromise.

Key facts for TL-2026-2025

Threat ID
TL-2026-2025
Also known as
GHSA-vwf4-m7j8-wcjf
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-15
Last reviewed
2026-08-15
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-as-a-service, consumer-electronics, business-intelligence
Target regions
North America
Detection rules
9
Indicators of compromise
10

Malware and tooling in Critical Metabase Zero-Day (CVE-2026-72898)

Malware and tooling: ProjectDiscovery Nuclei CVE-2026-72898 template

A critical unauthenticated SQL injection vulnerability in Metabase's POST /api/session/reset_password endpoint (CVE-2026-72898, CVSS 10.0) lets attackers inject arbitrary SQL and gain full administrator access without credentials. Metabase disclosed the flaw after discovering it was exploited as a zero-day against its own Metabase Cloud platform on 2026-08-03, with breaches confirmed at customers Framework, Tally, and Kilo Code. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2026-08-11.

How Critical Metabase Zero-Day (CVE-2026-72898) works

CVE-2026-72898 is an unauthenticated, network-exploitable SQL injection (CWE-89) in Metabase's password-reset flow. The POST /api/session/reset_password handler accepts a JSON body containing token and password but fails to strip additional, undeclared keys from that body. An attacker can add a user-id field shaped as a nested map (e.g. {"token":"x","password":"y","user-id":{"raw":"<SQL>"}}). Server-side, Clojure's merge function combines the attacker-supplied map into the internal lookup map without stripping the extra key, and Metabase's HoneySQL query layer treats a :raw key as a directive to embed a literal, unparameterized SQL fragment rather than a bound value. The result is blind SQL injection against the Metabase application database, reachable pre-authentication, which attackers use to manipulate the user lookup and elevate themselves to an administrator session. From there, an attacker has full administrative control of the Metabase instance: they can read and export any data reachable through Metabase's configured data-warehouse connections, and steal the stored connection credentials for every connected database.

Metabase itself was the first confirmed victim: a threat actor exploited the flaw as a zero-day against Metabase Cloud in a roughly four-hour window around 2026-08-03. Metabase detected the activity, blocked the vulnerable endpoints, and began notifying affected Cloud customers around 2026-08-06, publishing a security advisory and patched releases shortly after. Three customers have since gone public about being breached in that window: Framework (repairable-laptop manufacturer) had names, emails, phone numbers, physical/billing addresses, and login IPs exposed; Tally (form-builder SaaS) had email addresses and password hashes exposed; Kilo Code (AI coding-assistant company) had names, emails, and Slack access tokens exposed (the tokens were invalidated on discovery). No source has named or attributed the actor(s) behind the original zero-day exploitation.

After public disclosure, independent researchers (Wiz, Bishop Fox) published root-cause technical analyses, and a Nuclei detection/exploitation template for the flaw was published by ProjectDiscovery and further open-sourced PoC code circulated by 2026-08-10 — sharply lowering the bar for opportunistic mass exploitation of any of the roughly 2,500 internet-facing self-hosted Metabase instances identifiable via Shodan. CISA assigned the CVE and added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, with a federal remediation due date of 2026-08-14. Metabase Cloud instances were patched by the vendor; self-hosted and Enterprise Edition deployments required a manual upgrade to the fixed release for their branch.

The canonical exploitation log signature, published by the vendor, is a POST to /api/session/reset_password that returns HTTP 400 immediately followed by a GET to /api/user/current that returns HTTP 200 — indicating a failed injection probe followed by a successfully elevated session.

MITRE ATT&CK techniques used in TL-2026-2025

Discovery

T1087 Account Discovery

Persistence

T1098 Account Manipulation; T1136 Create Account

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Credential Access

T1552 Unsecured Credentials

Impact

T1565.001 Stored Data Manipulation

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning; T1596.005 Scan Databases

Affected products and versions in Critical Metabase Zero-Day (CVE-2026-72898)

  • Metabase — Metabase Open Source
    Vulnerable versions: 0.58.0-0.58.23; 0.59.0-0.59.20; 0.60.0-0.60.16; 0.61.0-0.61.10; 0.62.0-0.62.8; 0.63.0-0.63.4
    Fixed in: 0.58.24; 0.59.21; 0.60.17; 0.61.11; 0.62.9; 0.63.5
  • Metabase — Metabase Enterprise Edition
    Vulnerable versions: 1.58.0-1.58.23; 1.59.0-1.59.20; 1.60.0-1.60.16; 1.61.0-1.61.10; 1.62.0-1.62.8; 1.63.0-1.63.4
    Fixed in: 1.58.24; 1.59.21; 1.60.17; 1.61.11; 1.62.9; 1.63.5

Remediation for Critical Metabase Zero-Day (CVE-2026-72898)

Patches

  • Metabase 0.58.24 / Enterprise 1.58.24
  • Metabase 0.59.21 / Enterprise 1.59.21
  • Metabase 0.60.17 / Enterprise 1.60.17
  • Metabase 0.61.11 / Enterprise 1.61.11
  • Metabase 0.62.9 / Enterprise 1.62.9
  • Metabase 0.63.5 / Enterprise 1.63.5

Immediate actions

  • Block/restrict POST /api/session/reset_password at a WAF or reverse proxy until the instance is patched
  • Upgrade self-hosted Metabase to the patched release for your branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 (Enterprise Edition: 1.58.24-1.63.5)
  • Search reverse-proxy and application logs for the exploitation signature: POST /api/session/reset_password returning HTTP 400 immediately followed by GET /api/user/current returning HTTP 200
  • If the log signature is found, immediately revoke all active Metabase sessions and API keys and rotate every credential Metabase stores for connected databases

Workarounds

  • Block or rate-limit POST /api/session/reset_password at a WAF/reverse proxy as a temporary compensating control pre-patch

Longer-term hardening

  • Audit administrator account creation and modification events in Metabase for the suspected exploitation window
  • Rotate credentials for every database/data warehouse connected to the Metabase instance, since Metabase held those credentials in plaintext-accessible config reachable by an admin session
  • Remove direct internet exposure of self-hosted Metabase instances; place them behind VPN or SSO-fronted reverse proxy
  • Monitor connected data-warehouse query logs for anomalous large exports originating from the Metabase service account

CVEs associated with Critical Metabase Zero-Day (CVE-2026-72898)

CVE-2026-72898

Weaknesses (CWE) in Critical Metabase Zero-Day (CVE-2026-72898)

CWE-89

Timeline of Critical Metabase Zero-Day (CVE-2026-72898)

  • Metabase detects the anomalous activity and blocks the vulnerable /api/session/reset_password endpoint on Cloud infrastructure.
  • A threat actor exploits CVE-2026-72898 as a zero-day against Metabase's own Metabase Cloud platform in a roughly four-hour attack window.
  • Metabase publicly discloses the vulnerability (GHSA-vwf4-m7j8-wcjf) and ships patched releases for all affected 0.58-0.63 / 1.58-1.63 branches.
  • Metabase begins privately notifying affected Cloud customers, including Framework, of unauthorized access to their instance.
  • An independent researcher publishes technical analysis and a proof-of-concept lab for the vulnerability.
  • Framework, Tally, and Kilo Code publicly confirm they were breached via the Metabase flaw and detail the customer data exposed.
  • Public proof-of-concept exploit code is open-sourced, and a ProjectDiscovery Nuclei detection template is published, lowering the bar for mass exploitation.
  • CISA adds CVE-2026-72898 to its Known Exploited Vulnerabilities catalog.
  • CVE-2026-72898 is formally assigned to the vulnerability.
  • CISA-mandated remediation due date for U.S. federal agencies running affected Metabase instances.

Sources cited for Critical Metabase Zero-Day (CVE-2026-72898)

Threats related to Critical Metabase Zero-Day (CVE-2026-72898)

Detection coverage for TL-2026-2025

As of 2026-08-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2025 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats