CVE-2026-72898: Metabase's Unauthenticated SQL Injection Zero-Day
Technical root cause and remediation for the unauthenticated CVSS 10.0 SQL injection in Metabase password reset endpoint exploited as a zero-day.
An unauthenticated SQL injection vulnerability in Metabase's password reset endpoint was exploited in the wild as a zero-day against at least five organizations—handing attackers direct administrative access and database credentials before a patch was available.
CVE-2026-72898 (CWE-89: SQL Injection)
Severity & CVSS: Critical 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitation Status: ⚠️ Actively Exploited Zero-Day (Targeted campaigns observed by Wiz Research)
Affected Versions: Metabase 0.58.0 – 0.63.4 and Enterprise 1.x
Fixed In: Metabase 0.63.5 / 1.63.5
What's Affected
The vulnerability affects Metabase open-source versions 0.58.0 through 0.63.4 and the corresponding Enterprise Edition 1.x releases, whether self-hosted or hosted on Metabase Cloud prior to the vendor's emergency rollout.
Telemetry from Wiz Research indicates roughly 13% of cloud environments run self-hosted Metabase deployments, with approximately 2,500 instances directly exposed to the public internet according to Shodan telemetry.
The Vulnerability
CVE-2026-72898 is an unauthenticated SQL injection reachable via the public /api/session/reset_password API endpoint. Because Metabase did not release full technical details during disclosure, Wiz Research reverse-engineered the vulnerability by diffing the patched and unpatched JAR bytecode.
Technical Root Cause
The root cause lies in how Metabase handled password reset tokens. When processing a password reset request, the backend merged incoming JSON parameters directly into an unsanitized SQL query template without parameterized binding:
/api/session/reset_password flowed directly into internal SQL query execution when looking up user reset tokens in the Metabase application database (PostgreSQL/MySQL/H2).Attack Chain Breakdown
- Unauthenticated Endpoint Access: The attacker reaches
/api/session/reset_passwordwithout valid session credentials. - SQL Injection Payload: By injecting SQL syntax into the reset token parameter, the attacker extracts the application database schema and hashes from the underlying database.
- Admin Session Hijacking: Attackers extract or overwrite the administrative user's session token or update the admin email/password hash directly.
- Data Exfiltration: With administrative access to the Metabase web console, attackers gain direct query access to every data warehouse, operational database, and BI integration connected to the instance.
Indicators to Check For (IOCs)
POST requests to /api/session/reset_password containing SQL escape characters (', --, UNION, SELECT).
Audit Metabase audit logs for sudden admin account password resets or new admin accounts created outside change-control windows.
Check connected database query logs for unusual mass-export queries originating from the Metabase service account.
