Loading story…
Metabase disclosed and patched multiple critical vulnerabilities after a zero-day was exploited against Metabase Cloud, prompting urgent warnings for organizations running self-hosted instances. The flaws include two unauthenticated SQL injection issues, CVE-2026-72898 and CVE-2026-72899, and a missing authorization vulnerability, CVE-2026-72900. According to the advisories, CVE-2026-72898 can be abused through the /reset_password database endpoint to obtain administrator-level access, and both SQL injection bugs are reported as actively exploited.
Metabase said its cloud service was patched for customers, while national cybersecurity authorities urged self-hosted users to update immediately. Affected releases earlier than 63.5, 62.9, 61.11, 60.17, 59.21, and 58.24 should be upgraded to those fixed versions or later across the supported 0.58.x to 0.63.x branches. The notices emphasize prompt remediation because the vulnerabilities allow remote, unauthenticated compromise of exposed Metabase deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Metabase patched and updated Metabase Cloud for all cloud customers and released fixes for supported self-hosted branches. The fixed versions included 0.63.5, 0.62.9, 0.61.11, 0.60.17, 0.59.21, and 0.58.24, addressing CVE-2026-72898, CVE-2026-72899, and CVE-2026-72900.
On 2026-08-06, Metabase published an advisory stating that a zero-day vulnerability had been exploited in an attack against Metabase Cloud. The advisory said the flaws were being actively exploited and urged self-hosted users to update immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
infoworld.com
Open sourceacn.gov.it
Open sourcekyberturvallisuuskeskus.fi
Open sourceboho.or.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Metabase issued an urgent security update after detecting active attacks against the `POST /api/session/reset_password` endpoint, with related requests also observed to `/api/user/current` and affected sessions tied to the `core_session` component. The flaw, tracked as **CVE-2026-72898**, is a critical SQL injection vulnerability in the password reset functionality that can expose internet-facing Metabase instances to compromise. Metabase released patched minimum safe versions across supported branches: **v0.63.5**, **v0.62.9**, **v0.61.11**, **v0.60.17**, **v0.59.21**, and **v0.58.24**. Public detection logic was also added to ProjectDiscovery's Nuclei templates, which checks `/api/session/properties` to identify vulnerable versions, including `0.63.0` through versions earlier than `0.63.5`; until upgrades are completed, Metabase advised defenders to block access to the `/api/session/reset_password` endpoint as a temporary mitigation.
Aug 12, 2026
Metabase disclosed a **critical unauthenticated SQL injection zero-day** affecting `1.58+` that was actively exploited against Metabase Cloud tenants and vulnerable self-hosted deployments. The company said the flaw could give remote attackers administrator access and enable theft of stored database credentials and accessible data; it has since blocked the attack paths and released fixes. Metabase rated the issue `CVSS 10.0` and urged self-hosted customers to upgrade, revoke sessions, rotate credentials, and review logs for signs of compromise. The downstream impact has already hit multiple organizations. Framework told customers that attackers breached its Metabase-hosted cloud instance through the upstream provider and stole personal data affecting **all customers**, including names, email addresses, phone numbers, and physical addresses, but not payment information. Tally separately said an attacker accessed its Metabase analytics service and obtained user email addresses and password hashes, while stating that forms and submitted responses were stored separately and were not accessed. LexisNexis also reported disruption and unusual activity involving systems connected to its Metabase API through a third-party vendor.
Aug 16, 2026
CISA added three actively exploited vulnerabilities to its **Known Exploited Vulnerabilities** catalog: `CVE-2026-72898` in **Metabase**, `CVE-2026-68820` in the **Microsoft Windows Ancillary Function Driver for WinSock** (`afd.sys`), and `CVE-2026-20349` in **Cisco Secure Firewall ASA/FTD**. The Metabase issue is a critical unauthenticated SQL injection flaw affecting versions `1.58` and later that was reportedly abused as a zero-day against Metabase Cloud, with potential for administrator access and sensitive data exfiltration. The Windows bug is a use-after-free vulnerability that can lead to `SYSTEM`-level code execution or privilege escalation, while the Cisco flaw allows unauthenticated attackers to trigger denial-of-service conditions through crafted HTTP requests to the Remote Access SSL VPN service. Federal civilian agencies were ordered under **Binding Operational Directive 22-01** to remediate the Cisco and Metabase flaws by **August 14, 2026**, while the Windows vulnerability carries a deadline of **August 25, 2026**. Metabase said its cloud service was already protected after blocking abused endpoints and applying patches, but self-hosted deployments were urged to update immediately. Reporting on the KEV additions stressed that inclusion reflects confirmed exploitation in the wild, prompting urgent patching of Internet-facing Cisco devices, high-value Windows systems, and exposed Metabase instances rather than routine remediation.
Aug 15, 2026