Latest Metabase vulnerability: CVE-2026-72898 #
Metabase disclosed that certain versions of Metabase On-Premises are affected by a SQL injection vulnerability exploitable via a password reset API endpoint. Successful exploitation allows a remote, unauthenticated attacker with HTTP(S) access to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. The vulnerability has been designated CVE-2026-72898 and has been rated critical with a CVSS score of 10.0.
There is evidence that this vulnerability is being actively exploited in the wild and the vulnerability has been added to the CISA KEV list August 11th, 2026.
The following versions are affected
- Metabase: Versions x.63.0 through x.63.4.
- Metabase: Versions x.62.0 through x.62.8.
- Metabase: Versions x.61.0 through x.61.10.
- Metabase: Versions x.60.0 through x.60.16.
- Metabase: Versions x.59.0 through x.59.20.
- Metabase: Versions x.58.0 through x.58.23.
What is Metabase? #
Metabase is an open-source business intelligence tool used by organizations to visualize data and share insights through interactive dashboards. It is typically deployed in corporate environments to provide a graphical interface for querying databases such as PostgreSQL or MySQL.
What is the impact? #
Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
Are any updates or workarounds available? #
Users are strongly encouraged to update to the latest version as quickly as possible:
- Metabase x.63.x: Upgrade to version x.63.5 or later.
- Metabase x.62.x: Upgrade to version x.62.9 or later.
- Metabase x.61.x: Upgrade to version x.61.11 or later.
- Metabase x.60.x: Upgrade to version x.60.17 or later.
- Metabase x.59.x: Upgrade to version x.59.21 or later.
- Metabase x.58.x: Upgrade to version x.58.24 or later.
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Metabase AND product:=Metabase
