CVE-2026-72898 in Metabase
Summary
by MITRE • 08/10/2026
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authentication bypass and sql injection flaw in Metabase that allows remote attackers to escalate privileges without requiring valid credentials. The issue stems from improper input validation within the password reset functionality, specifically at the /reset_password database endpoint where user-supplied parameters are directly incorporated into sql queries without adequate sanitization or parameterization. This creates a classic sql injection vector that can be exploited by unauthenticated attackers to execute arbitrary database commands and potentially gain administrative control over the entire Metabase instance.
The technical exploitation occurs when an attacker submits malicious input through the password reset mechanism, which then gets processed by the backend sql engine without proper validation. This flaw falls under the CWE-89 category of sql injection, specifically representing a weakness in input validation where user-controllable data is directly used in sql construction. The vulnerability enables attackers to manipulate database queries and potentially extract sensitive information, modify database content, or execute administrative commands that would normally require legitimate authentication credentials.
The operational impact of this vulnerability extends beyond simple privilege escalation as it provides attackers with comprehensive access to all database resources connected to the Metabase instance. An attacker who successfully exploits this vulnerability can gain full administrative control over the application and its underlying database, potentially leading to data breaches, unauthorized modifications to analytics dashboards, and access to sensitive business intelligence. The unauthenticated nature of the exploit means that attackers do not need any prior credentials or network access to attempt the attack, making it particularly dangerous in environments where Metabase is exposed to the internet.
Security professionals should immediately implement mitigations including patching the affected Metabase versions, implementing proper input validation and parameterized queries throughout the application, and restricting access to sensitive endpoints through network segmentation. Organizations should also consider implementing web application firewalls to detect and block suspicious sql injection patterns targeting the password reset functionality. The vulnerability aligns with ATT&CK technique T1213.002 for data from databases and T1566.001 for credential harvesting, representing a significant risk to organizations that rely on Metabase for business intelligence and analytics. Regular security assessments of authentication mechanisms and input handling should be conducted to prevent similar vulnerabilities in other application components.