CVE entry · CVE-2026-72898
CVE-2026-72898: Metabase SQL Injection Vulnerability
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
- Actively exploited: added to CISA’s KEV catalog on August 11, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: August 14, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Metabase, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (www.metabase.com)
- Vendor advisory or reference cited by CISA (github.com)
- NVD entry (NIST)
- CISA KEV catalog