# Critical Metabase Zero-Day (CVE-2026-72898): Unauthenticated SQL Injection Grants Admin Access, Exploited in the Wild

> A critical unauthenticated SQL injection vulnerability in Metabase's POST /api/session/reset_password endpoint (CVE-2026-72898, CVSS 10.0) lets attackers inject arbitrary SQL and gain full administrator access without credentials. Metabase disclosed the flaw after discovering it was exploited as a zero-day against its own Metabase Cloud platform on 2026-08-03, with breaches confirmed at customers Framework, Tally, and Kilo Code. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2026-08-11.

- **Published:** 2026-08-15T00:00:00Z
- **Last reviewed:** 2026-10-09T13:48:31.758Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2025
- **ID:** TL-2026-2025
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-72898

## Description

CVE-2026-72898 is an unauthenticated, network-exploitable SQL injection (CWE-89) in Metabase's password-reset flow. The POST /api/session/reset_password handler accepts a JSON body containing token and password but fails to strip additional, undeclared keys from that body. An attacker can add a user-id field shaped as a nested map (e.g. {"token":"x","password":"y","user-id":{"raw":"<SQL>"}}). Server-side, Clojure's merge function combines the attacker-supplied map into the internal lookup map without stripping the extra key, and Metabase's HoneySQL query layer treats a :raw key as a directive to embed a literal, unparameterized SQL fragment rather than a bound value. The result is blind SQL injection against the Metabase application database, reachable pre-authentication, which attackers use to manipulate the user lookup and elevate themselves to an administrator session. From there, an attacker has full administrative control of the Metabase instance: they can read and export any data reachable through Metabase's configured data-warehouse connections, and steal the stored connection credentials for every connected database.

Metabase itself was the first confirmed victim: a threat actor exploited the flaw as a zero-day against Metabase Cloud in a roughly four-hour window around 2026-08-03. Metabase detected the activity, blocked the vulnerable endpoints, and began notifying affected Cloud customers around 2026-08-06, publishing a security advisory and patched releases shortly after. Three customers have since gone public about being breached in that window: Framework (repairable-laptop manufacturer) had names, emails, phone numbers, physical/billing addresses, and login IPs exposed; Tally (form-builder SaaS) had email addresses and password hashes exposed; Kilo Code (AI coding-assistant company) had names, emails, and Slack access tokens exposed (the tokens were invalidated on discovery). No source has named or attributed the actor(s) behind the original zero-day exploitation.

After public disclosure, independent researchers (Wiz, Bishop Fox) published root-cause technical analyses, and a Nuclei detection/exploitation template for the flaw was published by ProjectDiscovery and further open-sourced PoC code circulated by 2026-08-10 — sharply lowering the bar for opportunistic mass exploitation of any of the roughly 2,500 internet-facing self-hosted Metabase instances identifiable via Shodan. CISA assigned the CVE and added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, with a federal remediation due date of 2026-08-14. Metabase Cloud instances were patched by the vendor; self-hosted and Enterprise Edition deployments required a manual upgrade to the fixed release for their branch.

The canonical exploitation log signature, published by the vendor, is a POST to /api/session/reset_password that returns HTTP 400 immediately followed by a GET to /api/user/current that returns HTTP 200 — indicating a failed injection probe followed by a successfully elevated session.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1596.005 Scan Databases
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1087 Account Discovery
- T1136 Create Account
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1098 Account Manipulation
- T1565.001 Stored Data Manipulation
- T1078 Valid Accounts

## Sources

- [Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication](https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html)
- [Metabase Patches Vulnerability Exploited as Zero-Day](https://www.securityweek.com/metabase-patches-vulnerability-exploited-as-zero-day/)
- [Metabase zero-day exploited to access Framework customer data](https://www.helpnetsecurity.com/2026/08/10/metabase-zero-day-framework-tally-kilo-code/)
- [CISA Adds Three Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog)
- [CVE-2026-72898 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-72898)
- [Metabase Security Update](https://www.metabase.com/blog/security-update)
- [GHSA-vwf4-m7j8-wcjf: Metabase unauthenticated SQL injection](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)
- [Inside the Metabase SQLi: Exploited in the Wild](https://www.wiz.io/blog/inside-the-metabase-sqli-exploited-in-the-wild)
- [Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898](https://bishopfox.com/blog/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898)
- [Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access](https://cybersecuritynews.com/metabase-0-day-vulnerability/)
- [Metabase - Unauthenticated SQL Injection (Nuclei template)](https://cloud.projectdiscovery.io/library/CVE-2026-72898)
- [Metabase SQLi zero-day exploited in customer data-theft attacks](https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2025