CVE-2026-72899

Summary

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

Affected Software

VendorProductVersion RangeStatus
MetabaseMetabasex.58.0 < x.58.24affected
MetabaseMetabasex.58.24unaffected
MetabaseMetabasex.59.0 < x.59.21affected
MetabaseMetabasex.59.21unaffected
MetabaseMetabasex.60.0 < x.60.17affected
MetabaseMetabasex.60.17unaffected
MetabaseMetabasex.61.0 < x.61.11affected
MetabaseMetabasex.61.11unaffected
MetabaseMetabasex.62.0 < x.62.9affected
MetabaseMetabasex.62.9unaffected
MetabaseMetabasex.63.0 < x.63.5affected
MetabaseMetabasex.63.5unaffected

Weaknesses

  • CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References