CVSS v3
10
CRITICAL
EPSS Score
0.7%
exploit probability
CISA KEV
Yes
known exploited
Exploitation
—
SSVC status
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Yes. CVE-2026-72898 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 8/14/2026.
CVE-2026-72898 has a CVSS v3 base score of 10 (CRITICAL severity), with vector string 3.1.
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
Ranked by exploit probability (EPSS).