CVE-2026-72898: Metabase Metabase

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Vendor: Metabase
Product: Metabase
Vulnerability: Metabase SQL Injection Vulnerability
Date added: Aug 11, 2026
CISA due date (U.S. federal agencies): Aug 14, 2026
Known ransomware campaign use: Unknown
Weakness (CWE): CWE-89

References

NVD — CVE-2026-72898
www.metabase.com
github.com
www.cisa.gov
www.cisa.gov
nvd.nist.gov

This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.

Last updated: Oct 4, 2026 17:31 UTC · Catalog version 2026.10.02