CVE-2026-72898

Summary

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Affected Software

VendorProductVersion RangeStatus
MetabaseMetabasex.58.0 < x.58.24affected
MetabaseMetabasex.58.24unaffected
MetabaseMetabasex.59.0 < x.59.21affected
MetabaseMetabasex.59.21unaffected
MetabaseMetabasex.60.0 < x.60.17affected
MetabaseMetabasex.60.17unaffected
MetabaseMetabasex.61.0 < x.61.11affected
MetabaseMetabasex.61.11unaffected
MetabaseMetabasex.62.0 < x.62.9affected
MetabaseMetabasex.62.9unaffected
MetabaseMetabasex.63.0 < x.63.5affected
MetabaseMetabasex.63.5unaffected

Weaknesses

  • CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: active
    • Automatable: yes
    • Technical Impact: total

References