Loading story…
Metabase issued an urgent security update after detecting active attacks against the POST /api/session/reset_password endpoint, with related requests also observed to /api/user/current and affected sessions tied to the core_session component. The flaw, tracked as CVE-2026-72898, is a critical SQL injection vulnerability in the password reset functionality that can expose internet-facing Metabase instances to compromise.
Metabase released patched minimum safe versions across supported branches: v0.63.5, v0.62.9, v0.61.11, v0.60.17, v0.59.21, and v0.58.24. Public detection logic was also added to ProjectDiscovery's Nuclei templates, which checks /api/session/properties to identify vulnerable versions, including 0.63.0 through versions earlier than 0.63.5; until upgrades are completed, Metabase advised defenders to block access to the /api/session/reset_password endpoint as a temporary mitigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On August 11, 2026, CISA confirmed active exploitation of Metabase SQL injection flaw CVE-2026-72898 and added it to the Known Exploited Vulnerabilities catalog. The listing elevated the vulnerability's status as an actively exploited issue affecting Metabase's password reset endpoint.
Wiz reported that public proof-of-concept exploits for the Metabase SQL injection vulnerability CVE-2026-72898 were available by noon UTC on August 10, 2026. The write-up said the flaw had been exploited in the wild and increased urgency for self-hosted Metabase users to patch.
In the same August 6, 2026 notice, Metabase published minimum safe versions for supported branches: v0.63.5, v0.62.9, v0.61.11, v0.60.17, v0.59.21, and v0.58.24. It also advised customers to temporarily block the /api/session/reset_password endpoint until they could update.
On August 6, 2026, Metabase published an official urgent security notice warning of an active security incident affecting Metabase instances. The company said the observed attack activity targeted the /api/session/reset_password endpoint and was seen alongside requests to /api/user/current.
The pull request included validation showing the nuclei template successfully detected the issue on a vulnerable local Metabase instance and did not flag a patched instance running v0.63.5. The proof-of-concept referenced the POST /api/session/reset_password endpoint as part of the vulnerability context.
A GitHub pull request was created to add a nuclei template for detecting CVE-2026-72898, described there as a critical SQL injection vulnerability in Metabase via reset_password. The detection logic checks /api/session/properties for version information and targets vulnerable versions from 0.63.0 up to but not including 0.63.5.
Upwind reported that attackers initially targeted Metabase Cloud versions 1.58 and above as a zero-day before fixes were available. According to the report, Metabase contained the cloud threat by blocking affected endpoints and patching the underlying defect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
upwind.io
Open sourcelabs.beazley.security
Open sourcerunzero.com
Open sourcebishopfox.com
Open sourceramimac.me
Open sourceheise.de
Open sourcegithub.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Metabase disclosed and patched multiple critical vulnerabilities after a zero-day was exploited against **Metabase Cloud**, prompting urgent warnings for organizations running self-hosted instances. The flaws include two unauthenticated SQL injection issues, `CVE-2026-72898` and `CVE-2026-72899`, and a missing authorization vulnerability, `CVE-2026-72900`. According to the advisories, `CVE-2026-72898` can be abused through the `/reset_password` database endpoint to obtain administrator-level access, and both SQL injection bugs are reported as actively exploited. Metabase said its cloud service was patched for customers, while national cybersecurity authorities urged self-hosted users to update immediately. Affected releases earlier than **63.5, 62.9, 61.11, 60.17, 59.21, and 58.24** should be upgraded to those fixed versions or later across the supported `0.58.x` to `0.63.x` branches. The notices emphasize prompt remediation because the vulnerabilities allow remote, unauthenticated compromise of exposed Metabase deployments.
Aug 12, 2026
Metabase disclosed a **critical unauthenticated SQL injection zero-day** affecting `1.58+` that was actively exploited against Metabase Cloud tenants and vulnerable self-hosted deployments. The company said the flaw could give remote attackers administrator access and enable theft of stored database credentials and accessible data; it has since blocked the attack paths and released fixes. Metabase rated the issue `CVSS 10.0` and urged self-hosted customers to upgrade, revoke sessions, rotate credentials, and review logs for signs of compromise. The downstream impact has already hit multiple organizations. Framework told customers that attackers breached its Metabase-hosted cloud instance through the upstream provider and stole personal data affecting **all customers**, including names, email addresses, phone numbers, and physical addresses, but not payment information. Tally separately said an attacker accessed its Metabase analytics service and obtained user email addresses and password hashes, while stating that forms and submitted responses were stored separately and were not accessed. LexisNexis also reported disruption and unusual activity involving systems connected to its Metabase API through a third-party vendor.
Aug 16, 2026
Metabase disclosed **CVE-2026-59827**, a critical unsafe deserialization vulnerability that can lead to remote code execution on the Metabase server when instances use an H2 database connection, including the default sample database. The flaw allows an authenticated user with permission to run native H2 queries to return query result columns of type `OTHER`, causing Metabase to deserialize arbitrary Java objects. The issue carries a **CVSS 9.9** rating and affects versions `1.58.0` through before `1.58.15`, `1.59.0` through before `1.59.12`, `1.60.0` through before `1.60.6.3`, and `1.61.0` through before `1.61.1.4`. A related Metabase code change in the H2 database driver shows the remediation path: the application now checks JDBC result metadata and rejects columns typed as `JAVA_OBJECT` instead of attempting to parse them. That defensive change blocks unsafe handling of serialized Java objects in H2 query results and aligns with the vendor fixes released in versions `1.58.15`, `1.59.12`, `1.60.6.3`, and `1.61.1.4`.
Jul 10, 2026