Vulnerabilities

CVSS

10.0 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEVEU KEV

Published

2026-08-10

Status

Published

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Weaknesses

CWE-89

Coverage 1

vulnerability

Multiples vulnérabilités dans Metabase (24 août 2026)

Multiple vulnerabilities have been discovered in Metabase, allowing attackers to potentially compromise data confidentiality through SQL injection and an unspecified security issue. These vulnerabilities affect older ver…

CERT-FR · 6d ago Medium

CVE-2026-72898CVE-2026-72899CVE-2026-72900sql injectionvulnerabilitymetabase

All articles mentioning it

Advisories and references

• github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
• metabase.com/blog/security-update
• cve.org/CVERecord?id=CVE-2026-72898
• raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2...
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-...