CVE-2026-72898
Exploitation confirmed. First attested on 2026-08-10 by CISA-ADP, CISA KEV, GCVE · enisa-cnw-kev, GCVE · kevintel, GCVE · shadowserver.
- Published2026-08-10
- Fixed in1.63.5 · 1.62.9 · 1.61.11 · 1.60.17 · 1.59.21 · 1.58.24
- WeaknessCWE-89
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Timeline
dates in UTCVersions per branch
NVD| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 1.63 | ≥ 1.63.0, < 1.63.5 | 1.63.5 | NVD |
| 1.62 | ≥ 1.62.0, < 1.62.9 | 1.62.9 | NVD |
| 1.61 | ≥ 1.61.0, < 1.61.11 | 1.61.11 | NVD |
| 1.60 | ≥ 1.60.0, < 1.60.17 | 1.60.17 | NVD |
| 1.59 | ≥ 1.59.0, < 1.59.21 | 1.59.21 | NVD |
| 1.58 | ≥ 1.58.0, < 1.58.24 | 1.58.24 | NVD |
| 0.63 | ≥ 0.63.0, < 0.63.5 | 0.63.5 | NVD |
| 0.62 | ≥ 0.62.0, < 0.62.9 | 0.62.9 | NVD |
| 0.61 | ≥ 0.61.0, < 0.61.11 | 0.61.11 | NVD |
| 0.60 | ≥ 0.60.0, < 0.60.17 | 0.60.17 | NVD |
| 0.59 | ≥ 0.59.0, < 0.59.21 | 0.59.21 | NVD |
| 0.58 | ≥ 0.58.0, < 0.58.24 | 0.58.24 | NVD |
as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.
Products declared by the CNA1 product
As cisa-cg, the CNA that assigned this CVE, declared them in the CVE record; versions as written.
- Metabaseother versions: unknownAffected
- ≥ x.58.0, < x.58.24fixed in x.58.24custom
- ≥ x.59.0, < x.59.21fixed in x.59.21custom
- ≥ x.60.0, < x.60.17fixed in x.60.17custom
- ≥ x.61.0, < x.61.11fixed in x.61.11custom
- ≥ x.62.0, < x.62.9fixed in x.62.9custom
- ≥ x.63.0, < x.63.5fixed in x.63.5custom
Not affected = x.58.24 · = x.59.21
4 more version lines in the CVE record.
Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2026-08-10
Distribution builds and vendor advisories
Packages from OSV.dev and products from the vendors' CSAF advisories.
version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.
Packages
- metabaseChainguardall versions · fixed in 0.63.2-r1and 2 other packages
Vendor advisories
Metabase SQL injection
Metabase Metabase >=x.58.0|<x.58.24 · Metabase Metabase >=x.59.0|<x.59.21 · Metabase Metabase >=x.60.0|<x.60.17 · +3 more
Fix
- Update Metabase to 1.63.5 · 1.62.9 · 1.61.11 · 1.60.17 · 1.59.21 · 1.58.24 · 0.63.5 · 0.62.9
- CISA’s required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.due 2026-08-14
- Vendor fix CISA VA-26-222-01 · 1 productFixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.
Advisories and patches
- github.comMitigation · Patch · Vendor Advisory
- www.metabase.comMitigation · Patch · Vendor Advisory
Detection
read 2026-11-12 10:22 UTC- Nuclei template
- available ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof of concept
- PoC-in-GitHub11 repositories, unverifiedknown since 2026-11-12ashrafzaryouh/CVE-2026-728984minx/CVE-2026-72898ubitquity/Metabase-Setup-Endpoint-SQLi-FixVuxNx/CVE-2026-72898Franc-Zar/CVE-2026-72898-safe-detection
- Metasploit modules
- none listed Metasploit Framework
CISA Known Exploited Vulnerability
- Date Added
- 2026-08-11
- Patch Due Date
- 2026-08-14
- Ransomware Use
- Unknown
- Required Action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
- NVDCVE recordread 2026-10-23
- CISA KEVKEV entry2026-08-11
- ENISA EUVDexploitation2026-08-112026-08-11
- GCVEexploitation2026-08-10
- CISA-ADPSSVC decisionactive2026-08-12
- CNACVSS 4.010known since 2026-10-23
- CNACVSS 3.110known since 2026-10-23
- CNAweakness (CWE)CWE-89known since 2026-10-23
- FIRST EPSSEPSS score98.2 %read 2026-11-12
- PoC-in-GitHubproof of concept11known since 2026-11-12
- ProjectDiscoverydetectionread 2026-11-12
- OSVaffected packages—
Identifiers
- CGA-4f3h-5p34-647fsame flawChainguard · CC-BY-NC-ND-4.0
- CGA-52cm-5j7x-7rxrsame flawChainguard · CC-BY-NC-ND-4.0
- CGA-79x3-8r4x-6ff3same flawChainguard · CC-BY-NC-ND-4.0
- CGA-qc5q-8hj9-ff2wsame flawChainguard · CC-BY-NC-ND-4.0
- CGA-rrjw-m77v-rqv5same flawChainguard · CC-BY-NC-ND-4.0
- CGA-wf24-3qxv-cf4jsame flawChainguard · CC-BY-NC-ND-4.0
- EUVD-2026-55690same flawENISA EUVD · LicenseRef-ENISA-legal-notice
Technical details
- CVSS v3 Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CVSS 4.0 vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Published
- 2026-08-10
- Last Modified
- 2026-08-12
- NVD status
- Analyzed
Frequently asked questions
What is CVE-2026-72898?
Is CVE-2026-72898 actively exploited?
What is the CVSS score for CVE-2026-72898?
Running metabase? Hear about its next vulnerability
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- For a threat intelligence platform: malware, C2 and ransomware indicators over STIX/TAXII.
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.
- CVE-2023-38646same product
- CVE-2023-37470same product
- CVE-2026-55858same productMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client
- CVE-2026-33725same product
- CVE-2026-56819same productNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
- CVE-2026-55833same productNetty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
- CVE-2026-55831same productNetty SPDY SETTINGS frame count materializes unbounded settings map
- CVE-2026-73508same product
Sources for this record
- CISA ICS advisories (CSAF) · Public domain (US Government work)
- CISA KEV · CC0-1.0 (cisagov/kev-data)
- CVE Program · CVE Program Terms of Use
- ENISA EU Vulnerability Database · ENISA legal notice §1.2 (reproduction authorised, provided the source is acknowledged)
- FIRST EPSS · EPSS terms of use (free use, attribution requested)
- GCVE · GCVE dump terms (preserve source attribution)
- Nuclei templates · MIT
- NVD · Public domain (17 U.S.C. § 105) for NVD-authored data; third-party content under its own terms
- OSV.dev · Per record, as its publisher states it: each row carries the label in sourceLicense when one is served
- PoC-in-GitHub · CC0-1.0
- CISA Vulnrichment · CC0-1.0