Metabase Zero-Day CVE-2026-72898: Active Exploitation, CVSS…

A maximum-severity CVSS 10.0 zero-day struck Metabase on August 2, 2026. The attack, confirmed against the vendor's cloud infrastructure and already exploited in the wild, leverages a pre-authentication endpoint to execute arbitrary SQL in the application database, creating a direct path to administrative privileges and, from there, the entire connected enterprise data layer. CISA has added the flaw to the KEV catalog with a patching deadline of August 14 for federal agencies.

A maximum-severity CVSS 10.0 zero-day struck Metabase on August 2, 2026. The attack, confirmed against the vendor's cloud infrastructure and already exploited in malicious activity, exploits a pre-authentication endpoint to execute arbitrary SQL in the application database, opening a direct path to administrative privileges and, from there, the entire connected enterprise data layer. CISA has added the flaw to the KEV catalog with a patching deadline of August 14 for federal agencies.

Key Takeaways

CVE-2026-72898 is an unauthenticated SQL injection on the /api/session/reset_password endpoint with CVSS 10.0 CRITICAL in both versions 3.1 and 4.0
Metabase Cloud was compromised for approximately four hours on August 2, 2026; the vendor blocked the endpoint and released patches for six version branches (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5)
Framework, n8n, and Kilo Code confirmed customer data exposure, with 136 n8n records containing names and emails accessible to the attacker
Wiz estimates roughly 2,500 self-hosted Metabase instances exposed on the internet, with 13% of cloud environments hosting the software and 25% of those fully accessible from the public network

The Mechanism: Pre-Auth SQL Injection with Immediate Escalation

The vulnerability resides in the /api/session/reset_password endpoint, reachable without authentication. According to the official CVE-2026-72898 record, a remote attacker can inject arbitrary SQL into the Metabase application database through this path and gain administrative access to the compromised instance. The GitHub Security Advisory GHSA-vwf4-m7j8-wcjf confirms the same chain: injection, arbitrary query execution, full instance control.

The classifying CWE is 89, "Improper Neutralization of Special Elements used in an SQL Command." The primary Metabase source describes the attack pattern with operational precision: a POST request to the vulnerable endpoint with an HTTP 400 response, followed by a GET to /api/user/current with a 200 response, indicates compromise has occurred. This IoC was repeated in official communications from CEO Sameer Al-Sakran.

A structural finding emerges from analysis by Johannes Ullrich of the SANS Internet Storm Center, cited by Dark Reading: Metabase "apparently does not use prepared statements, which would fix this issue." The architectural choice, driven by the need to support multiple database engines, leaves the code exposed to injections that prepared statements would have blocked. The attack vector requires no user interaction, no prior privileges, and operates over the network: the CVSS vector string AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects this lethal combination.

"If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised" — Sameer Al-Sakran, CEO Metabase

Confirmed Victims and the Real Blast Radius

The incident did not remain theoretical. Three organizations published technical disclosures with measurable details. Framework, the modular PC manufacturer, notified customers that names, login IP addresses, physical addresses, phone numbers, and email addresses were accessible; payment data was explicitly excluded. n8n, the workflow automation platform, confirmed 136 customer records with names and emails, plus 5 records with bcrypt-hashed passwords and 25 accounts with historical plaintext passwords — the latter stemming from a prior April 2023 bug, not directly linked to the Metabase attack but made visible by the compromise. Kilo Code reported access to customer records and, for a subset of users, exposure of Slackbot tokens.

The blast radius exceeds the perimeter of a single BI product. By definition, Metabase connects to data warehouses, transactional databases, and enterprise data lakes. Administrative control of the instance allows access to database connection configurations, execution of arbitrary queries on linked systems, and, potentially, exfiltration of data volumes significantly larger than those contained in the local application database. This characteristic turns every compromised instance into a pivot point toward the underlying data infrastructure.

Wiz, with visibility into public clouds, provided the operational estimate: roughly 13% of monitored cloud environments host self-hosted Metabase instances, and roughly 25% of those are fully accessible from the internet. The projection converges on approximately 2,500 exposed instances. This number does not indicate compromise, but defines the potential attack surface for continued exploitation beyond the August 2 cloud incident.

Historical Context: CVE-2023-38646 and the Metabase Pattern

The security community has recorded a direct precedent. In 2023, Metabase faced CVE-2023-38646, a pre-authentication RCE vulnerability with active exploitation and inclusion in the KEV catalog. The recurrence of critical flaws on the pre-authentication axis three years apart raises documented questions about the maturity of the product's security development lifecycle. Both vulnerabilities allowed unauthorized access from the internet without prerequisites; both reached exploitation in the wild before widespread patching; both struck the same vendor specialized in analytics, not security infrastructure.

The difference in 2026 is the cloud-first ecosystem. Self-hosted instances remain under customer responsibility, but the compromise of Metabase Cloud demonstrated that even the vendor-managed SaaS model does not fully immunize against zero-day risk. Downstream customers — Framework, n8n, Kilo Code — were not necessarily direct Metabase users, but suffered PII exposure through the commercial relationship with the analytics provider.

Immediate Actions

Priority actions derive directly from official sources and convergent advisories:

Verify IoC presence in logs: search for the sequence POST /api/session/reset_password with status 400 followed by GET /api/user/current with status 200 in application and network logs of the instance
Apply patches for the branch in use: Metabase has released fixed versions for six branches: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 — updating is mandatory for all instances on branches 58-63
Rotate exposed credentials and tokens: in case of confirmed or suspected compromise, rotate administrative passwords and connection secrets for linked databases, as well as verify service tokens such as the Slackbot tokens reported in the Kilo Code disclosure
Reduce network exposure: for self-hosted instances not required publicly, restrict access to authorized IPs or corporate VPN, given the vector requires network reachability of the vulnerable endpoint

The CISA Deadline and Federal Urgency

CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog on August 11, 2026. Binding Operational Directive 26-04 requires U.S. federal agencies to apply fixes by August 14, 2026. This extremely compressed timeline reflects the combination of documented exploitation, maximum severity, and potential impact on systems that often integrate sensitive government data.

For the private sector, the federal deadline serves as an escalation signal. The convergence of primary advisory (GitHub Security Advisory), official CVE record, government catalog, and confirmed victim disclosures eliminates uncertainty about criticality. The element distinguishing this event from theoretical advisories is the measurable forensic trail: attack timestamp, recognizable log pattern, disclosures with precise exposed record counts.

The open question, documented in sources as unresolved, concerns the threat actor's identity and motive. No infrastructure overlaps with known groups emerge in the sources consulted. The concentrated duration of the cloud attack — approximately four hours — could indicate a targeted objective and rapid collection, but this is editorial reading not confirmed by primary sources.

The Metabase 2026 case confirms that analytics tools, by their architectural position between user interface and data warehouse, constitute high-value targets for attackers and maximum-risk points for defenders. The maximum CVSS severity is not hyperbole: it is the mathematical calculation of a vector that requires zero prerequisites and delivers complete control with immediate pivoting.

Information verified against cited sources and current as of publication.

Sources

Sources and references