01 Record

CVE-2026-72898

Metabase SQL injection via password reset endpoint

CriticalKEVPUBLISHEDCNA: cisa-cg

Base score10.0 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

02 Description

Metabase SQL injection via password reset endpoint

Published

2026-08-10 17:55Z4 DAYS AGO

Last updated

2026-08-12 14:50Z2 DAYS AGO

Reserved

2026-08-10

Assigning CNA

cisa-cg

Record state

PUBLISHED

Severity

Critical (CVSS 10.0)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Weaknesses

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Base

SSVC decision

ExploitationactiveAutomatableyesTechnical Impacttotal

KEV catalog

Added 2026-08-11 · remediation due 2026-08-14

Data version

5.2

Document digest

9f308548970da8bf040a2e9ce5fd4f16cbd9151aee8cb73f6c35cdca534fcf5c

VendorProductVersionsPlatforms

MetabaseMetabasex.58.0 to < x.58.24, x.59.0 to < x.59.21, x.60.0 to < x.60.17, x.61.0 to < x.61.11, x.62.0 to < x.62.9, x.63.0 to < x.63.5—