CVE-2026-72898

Metabase SQL injection in password reset endpoint

critical · 10.0

Known exploited

Fix listed

Metabase

Published Aug 10, 2026, 17:55 UTC

Description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Reported fixed versions

x.58.24, x.59.21, x.60.17, x.61.11, x.62.9

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.