Metabase SQL Injection — exploitable from the network with no login

What it is

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Why it matters

• CISA added it to the Known Exploited Vulnerabilities catalogue on August 11, 2026 — observed exploitation, on the record.
• EPSS puts the chance of exploitation in the next 30 days at 94.2% — the top 0.2% of all scored CVEs.
• CVSS 10.0 (critical), and it is reachable over the network, needs no credentials, needs no user interaction.

What to do

• Patch it. CISA's deadline for federal agencies was August 14, 2026 and has already passed.
• Check GitHub's advisory for affected versions: https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf

---

Drafted from CVE-2026-72898 — CISA KEV, NVD, FIRST EPSS. Check before publishing.