Metabase - SQLi (CVE-2026-72898)

CVE-2026-72898 is a critical unauthenticated SQL injection in the password-reset endpoint of Metabase, POST /api/session/reset_password, affecting both the open-source and Enterprise editions. An attacker can manipulate authentication data to obtain administrator access, then read the credentials of connected databases and the data they expose. CISA added it to the KEV catalogue on 11 August 2026.

CrowdSec has been tracking this vulnerability and its exploits since 12th of August 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-72898 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec network telemetry also shows that exploitation of CVE-2026-72898 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers post crafted password-reset requests to /api/session/reset_password, injecting SQL through the reset token to alter authentication data and take over the administrator account.