A critical SQL injection vulnerability in Metabase, tracked as CVE-2026-72898, could allow unauthenticated remote attackers to compromise vulnerable instances and obtain administrator-level control.
The flaw, classified under CWE-89, affects the application’s own database layer and creates a path to expose connected data sources, stored credentials, and sensitive business intelligence records.
The issue was added to CISA’s Known Exploited Vulnerabilities catalog on August 11, 2026, with a remediation deadline of August 14. Organizations that operate Metabase, particularly internet-facing deployments, should treat the vulnerability as an immediate patching.
Critical Metabase Flaw
An attacker does not need valid Metabase credentials to exploit CVE-2026-72898. A remote adversary can inject arbitrary SQL statements into the Metabase application database, potentially altering data or manipulating application state.
Unlike SQL injection flaws that are limited to extracting information from a single backend query, this vulnerability affects the database that supports Metabase itself.
That distinction substantially raises the potential impact: the application database can contain user accounts, authorization settings, configuration values, session-related records, encrypted or stored connection details, and metadata describing connected data environments.
An attacker able to manipulate those records could establish or elevate an account to administrator access. From there, the intruder would no longer be constrained to the initial injection vector.
Administrative control over a Metabase instance can enable broad data exposure. Attackers may change application configuration, access stored credentials for connected databases, query information available through those connections, and export the results.
For organizations using Metabase as a centralized analytics platform, a compromise of a single web application can lead to access to multiple business systems.
Connected sources may include production databases, data warehouses, cloud analytics services, customer datasets, financial reporting platforms, or internal operational repositories.
The downstream impact will depend on Metabase’s configured database connections and the privileges assigned to those credentials.
Instances connected to highly privileged service accounts pose the greatest risk, because a compromised Metabase administrator may grant access to far more data than the platform itself directly stores.
CISA currently lists ransomware use as unknown. However, the absence of confirmed ransomware activity should not be interpreted as low risk. Unauthenticated exploitation, administrator takeover, and credential theft are capabilities commonly associated with extortion.
Mitigation
Organizations should apply vendor-provided mitigations in accordance with Metabase instructions and validate that the remediation is effective across every deployment.
Security teams should prioritize externally exposed instances, including self-hosted cloud deployments and systems reachable through reverse proxies or single sign-on gateways.
Federal civilian agencies must follow CISA’s Binding Operational Directive 26-04 guidance and associated forensic-triage requirements.
Other organizations should use the August 14 due date as a strong indicator of urgency: vulnerable Metabase deployments should be patched, isolated, or removed from service without delay.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
