# CVE-2026-72898: Metabase - SQLi

> Live exploitation tracking for CVE-2026-72898 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-72898

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Metabase
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** enterprise_software, web_application

## Description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

## CrowdSec analysis

[CVE-2026-72898](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-72898) is a critical unauthenticated SQL injection in the password-reset endpoint of Metabase, `POST /api/session/reset_password`, affecting both the open-source and Enterprise editions. An attacker can manipulate authentication data to obtain administrator access, then read the credentials of connected databases and the data they expose. CISA added it to the KEV catalogue on 11 August 2026.

CrowdSec has been tracking this vulnerability and its exploits since 12th of August 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-72898 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2026-72898 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers post crafted password-reset requests to `/api/session/reset_password`, injecting SQL through the reset token to alter authentication data and take over the administrator account.

## Timeline

- 2026-08-10: CVE Published. CVE-2026-72898 is published to NVD.
- 2026-08-11: CISA KEV. CVE-2026-72898 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-08-12: Rule Released. CrowdSec releases a rule to detect CVE-2026-72898 exploitation attempts against the CrowdSec Network.
- 2026-08-12: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-72898 for the first time.
- 2026-08-14: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://www.metabase.com/blog/security-update
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json
- https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
- https://www.cve.org/CVERecord?id=CVE-2026-72898

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-72898) follows observed exploitation activity for CVE-2026-72898. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.