Loading story…
MBSD-SOC reported increased attack activity in September targeting CVE-2026-72898, a critical SQL injection vulnerability in the open-source business intelligence platform Metabase. The flaw affects an unauthenticated endpoint and can enable authentication bypass and administrator access. MBSD-SOC assigned it a CVSS v3.0 score of 10.0 and reported that public proof-of-concept code is available. Observed probes submitted crafted JSON to /api/session/reset_password; the report describes attack attempts, not confirmed compromises.
MBSD-SOC first detected targeting on August 19, 2026, followed by intermittent activity that increased in September. Metabase had published an urgent security-update notice on August 6 calling on users to upgrade. Organizations running Metabase should promptly upgrade affected deployments to the latest version and review requests to the password-reset endpoint for suspicious activity, particularly where the application is internet-accessible.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC published its September detection report, describing crafted JSON POST requests to /api/session/reset_password that tested for SQL injection. The report noted that public proof-of-concept code was available and urged affected organizations to upgrade.
MBSD-SOC observed increased targeting of CVE-2026-72898 during September, following intermittent activity that began in August.
MBSD-SOC first detected attacks targeting the Metabase vulnerability, with intermittent targeting observed afterward.
CVE-2026-72898 was publicly disclosed as a critical SQL injection vulnerability in an unauthenticated Metabase endpoint. Successful exploitation can bypass authentication and grant administrator privileges; MBSD-SOC assigns it a CVSS v3.0 score of 10.0.
Metabase announced that a security update was available and urged users to upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Metabase issued an urgent security update after detecting active attacks against the `POST /api/session/reset_password` endpoint, with related requests also observed to `/api/user/current` and affected sessions tied to the `core_session` component. The flaw, tracked as **CVE-2026-72898**, is a critical SQL injection vulnerability in the password reset functionality that can expose internet-facing Metabase instances to compromise. Metabase released patched minimum safe versions across supported branches: **v0.63.5**, **v0.62.9**, **v0.61.11**, **v0.60.17**, **v0.59.21**, and **v0.58.24**. Public detection logic was also added to ProjectDiscovery's Nuclei templates, which checks `/api/session/properties` to identify vulnerable versions, including `0.63.0` through versions earlier than `0.63.5`; until upgrades are completed, Metabase advised defenders to block access to the `/api/session/reset_password` endpoint as a temporary mitigation.
Aug 12, 2026
Metabase disclosed and patched multiple critical vulnerabilities after a zero-day was exploited against **Metabase Cloud**, prompting urgent warnings for organizations running self-hosted instances. The flaws include two unauthenticated SQL injection issues, `CVE-2026-72898` and `CVE-2026-72899`, and a missing authorization vulnerability, `CVE-2026-72900`. According to the advisories, `CVE-2026-72898` can be abused through the `/reset_password` database endpoint to obtain administrator-level access, and both SQL injection bugs are reported as actively exploited. Metabase said its cloud service was patched for customers, while national cybersecurity authorities urged self-hosted users to update immediately. Affected releases earlier than **63.5, 62.9, 61.11, 60.17, 59.21, and 58.24** should be upgraded to those fixed versions or later across the supported `0.58.x` to `0.63.x` branches. The notices emphasize prompt remediation because the vulnerabilities allow remote, unauthenticated compromise of exposed Metabase deployments.
Aug 12, 2026
Metabase disclosed a **critical unauthenticated SQL injection zero-day** affecting `1.58+` that was actively exploited against Metabase Cloud tenants and vulnerable self-hosted deployments. The company said the flaw could give remote attackers administrator access and enable theft of stored database credentials and accessible data; it has since blocked the attack paths and released fixes. Metabase rated the issue `CVSS 10.0` and urged self-hosted customers to upgrade, revoke sessions, rotate credentials, and review logs for signs of compromise. The downstream impact has already hit multiple organizations. Framework told customers that attackers breached its Metabase-hosted cloud instance through the upstream provider and stole personal data affecting **all customers**, including names, email addresses, phone numbers, and physical addresses, but not payment information. Tally separately said an attacker accessed its Metabase analytics service and obtained user email addresses and password hashes, while stating that forms and submitted responses were stored separately and were not accessed. LexisNexis also reported disruption and unusual activity involving systems connected to its Metabase API through a third-party vendor.
Sep 3, 2026