Metabase SQL Injection Vulnerability (CVE-2026-72898) Enables Full System Takeover

An unauthenticated SQL injection vulnerability tracked as CVE-2026-72898 poses a maximum-severity risk to Metabase deployments. Rated with a CVSS score of 10.0, the flaw allows a remote, unauthenticated attacker to inject arbitrary SQL statements directly into the Metabase application database. Successful exploitation bypasses authentication entirely, providing administrative privileges over the application and exposing every downstream data store connected to the instance.

The Attack Path: From Web Endpoint to Data Warehouse

Metabase relies on an internal application database (such as PostgreSQL, MySQL, or H2) to store configuration settings, user accounts, session tokens, and encrypted credentials for connected data sources. CVE-2026-72898 exists within an unauthenticated API endpoint that fails to sanitize user-supplied input before incorporating it into SQL queries targeting this application database.

An attacker targeting an exposed instance can craft malicious payloads to read or modify the underlying database tables. The initial objective in wild exploitation of this attack class is typically privilege escalation:

1. Application Takeover: The attacker modifies user tables or inserts an administrator session token directly into the database, gaining full control over the Metabase web interface and API.
2. Credential Extraction: Once logged in as an administrator—or by querying the application database directly via SQL injection—the attacker extracts stored connection strings and credentials for enterprise data warehouses (such as Snowflake, BigQuery, Redshift, or PostgreSQL).
3. Data Exfiltration: Using Metabase’s built-in query runner or connecting directly to the backend data warehouses using stolen credentials, the attacker reads, modifies, or exports sensitive corporate data.

Because Metabase is designed specifically to aggregate and query broad datasets across an enterprise, compromising the application effectively hands the attacker the keys to the entire corporate data architecture.

Target Exposure and Deployment Risks

Business intelligence (BI) tools like Metabase represent high-value targets for threat actors due to their unique position in enterprise network topologies. Organizations frequently deploy Metabase on internet-facing infrastructure to enable remote employee access, power embedded analytics in SaaS products, or serve customer-facing dashboards.

Instances exposed directly to the public internet without IP whitelisting or pre-authentication proxies (such as a Web Application Firewall or SSO gateway) are at immediate risk of automated scanning and exploitation. Even within internal networks, an unauthenticated flaw allows an attacker who has gained a initial foothold on a corporate workstation to pivot directly into core databases without needing valid domain credentials.

Mitigation and Forensic Triage Requirements

Organizations running Metabase must prioritize remediation for CVE-2026-72898 immediately, especially where instances are reachable from the public internet.

• Apply Security Updates: Upgrade all Metabase instances to the latest patched version supplied by the vendor. If an immediate upgrade is not feasible, restrict network access to the Metabase service using strict firewall rules or a VPN.
• Inspect Application Users: Examine the Metabase application database (specifically the core_user table) for newly created accounts, unfamiliar administrator email addresses, or unexpected password reset events.
• Audit Database Connections and Logs: Review Metabase audit logs for unusual export activity, high-volume query execution, or modifications to database connection settings. Inspect connection logs on downstream data warehouses for query traffic originating from the Metabase host outside normal business hours or baseline volumes.
• Rotate Stored Credentials: If there is any indication that an instance was accessed prior to patching, treat all database passwords, SSH keys, and service account tokens stored within Metabase as compromised and rotate them immediately.
• Compliance Deadlines: Federal civilian agencies and organizations following CISA’s BOD 26-04 guidelines must apply vendor-provided mitigations or remove non-compliant internet-facing assets by August 14, 2026, while conducting mandatory forensic triage on vulnerable endpoints.