CVE-2026-72898: Metabase SQL Injection Vulnerability

CVE-2026-72898 is a SQL injection weakness in Metabase that can let an unauthenticated remote attacker inject arbitrary SQL into the Metabase application database. Successful abuse can lead to administrator access on the Metabase instance, after which an attacker could change configuration, steal stored credentials for connected databases, read data reachable through those connections, and export data. For IT and security teams, this matters because Metabase often sits at the intersection of analytics users and production or warehouse data sources, so compromise can expand well beyond the Metabase host itself. Confirm exact affected releases, fixed builds, and deployment notes against the vendor advisory.

CISA describes the issue as allowing unauthenticated remote SQL injection into the application database with a path to admin-level control. Known ransomware use is not documented in the provided facts. Treat internet-exposed or broadly reachable instances as higher priority for inventory and remediation.

How it works

This vulnerability is classed as CWE-89 (SQL injection). In this class of flaw, attacker-controlled input is incorporated into database queries without adequate separation of code and data. An unauthenticated remote attacker who can reach the vulnerable application surface may supply crafted input that the backend interprets as part of SQL against the Metabase application database rather than as harmless data.

Per the CISA summary, injection into that application database can yield administrator access to the Metabase instance. With admin control, an attacker is positioned to alter application configuration, obtain stored credentials used to connect to other databases, query or export data available through those connections, and otherwise abuse the trust Metabase holds as a central analytics layer. Specific request paths, parameters, or payloads are not provided here; do not assume exploit details—validate mechanics and preconditions only from the vendor advisory and your own controlled testing policy.

Am I affected? How to find it in your systems

Metabase is commonly deployed as a self-hosted service (containers, VMs, or package installs) or used as a managed/cloud offering for business intelligence and SQL-oriented dashboards. It may run on internal networks, in cloud VPCs, or on hosts intentionally exposed for remote analyst access.

• Inventory: Search CMDB, container registries, orchestration manifests, reverse-proxy configs, and software bills of materials for Metabase. Identify hosts and URLs that serve the Metabase UI or API.
• Version and config: Record the running Metabase version and edition from the admin interface, deployment image tags, or package metadata. Compare those versions and any stated configuration prerequisites only against the vendor advisory for CVE-2026-72898—do not rely on version lists that are not in that advisory.
• Exposure: Note whether instances are reachable from the internet, partner networks, or large internal user populations without strong authentication at the edge. Stakeholders should evaluate each asset’s internet exposure in line with applicable BOD 26-04 expectations described in the CISA required action.
• Telemetry: Review reverse-proxy, WAF, and application logs for anomalous unauthenticated traffic to Metabase, unusual query or error patterns consistent with SQL injection attempts, sudden privilege or configuration changes, unexpected exports, or new admin users. SQL injection often surfaces as database errors, odd query shapes, or spikes in failed then successful privileged activity—tune detections to your logging stack without assuming a single signature.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation instructions for Metabase that address CVE-2026-72898, and verify the fixed build is what actually runs in each environment (image digest, package version, or vendor-confirmed release). Align prioritization and cloud-versus-self-hosted handling with CISA’s direction: apply mitigations per vendor instructions, ensure compliance with BOD 26-04 risk-based update prioritization and forensics triage requirements as applicable, follow BOD 26-04 guidance for cloud services, or discontinue use if mitigations are unavailable.

• After upgrading, rotate credentials that Metabase stored for connected data sources if you suspect exposure, and review admin accounts, SSO mappings, and configuration for unauthorized changes.
• Harden the service: restrict network paths to Metabase to trusted networks or identity-aware proxies; enforce strong authentication and least-privilege roles inside Metabase; limit which data sources and credentials the instance may use; disable unused features and public-sharing options if your deployment allows them.
• Ensure database users configured in Metabase use least privilege (read-only where possible, scoped schemas) so a compromised analytics layer cannot freely administer backend systems.
• Re-validate backups and export paths so bulk data exfiltration is harder and recovery is tested.

If you can't patch immediately

Reduce reachability and monitor aggressively until the vendor fix is installed.

• Segmentation: Place Metabase behind VPN, private networking, or allowlisted ingress; remove direct internet exposure wherever feasible.
• Edge controls: Use a reverse proxy or WAF with strict allowlists and rules aimed at common SQL injection patterns as temporary virtual patching—knowing signature-based controls are incomplete and must not replace the vendor update.
• Feature reduction: Disable or restrict unauthenticated or anonymous access paths, public links, and any optional modules you do not need, consistent with vendor guidance.
• Credential and data blast radius: Temporarily disconnect high-value data sources, replace overly privileged connector accounts, and throttle or alert on large exports.
• Monitoring: Heighten alerting on auth anomalies, configuration changes, new admins, and unusual database activity from the Metabase service account. Preserve logs to support the forensics triage expectations referenced by CISA if compromise is suspected.

If your data may have been exposed

Actively exploited vulnerabilities of this severity class can lead to full application takeover and downstream database access, including theft of stored connector credentials and bulk read or export of business data. If your Metabase instance may have been reachable and unpatched, assume potential exposure of application configuration, embedded secrets, and data accessible via configured connections until investigation says otherwise: isolate the instance, rotate secrets, review admin and data-source activity, and follow your incident response process alongside CISA’s forensics triage requirements where they apply. You can run a free exposure scan of your email to check known breach data as one additional personal or staff-awareness step while corporate investigation proceeds.