Thousands of Self-Hosted Metabase Instances Exposed by CVE-2026-72898

Summary

A critical unauthenticated SQL injection vulnerability in Metabase version 0.58 and later allows attackers to obtain administrator access to the application database. This flaw can enable theft of connected-database credentials and may facilitate lateral movement. Exploitation has already been seen in the wild before public disclosure.

Investigation

Dataminr’s TRACE team conducted an internet-wide scan identifying approximately 11,000 self-hosted Metabase instances, including 4,309 marked as potentially vulnerable. The review found that over 97% of fingerprinted hosts on affected branches remained unpatched. Several Metabase Cloud tenants have already disclosed unauthorized data access incidents.

Mitigation

Organizations should immediately upgrade self-hosted Metabase deployments to the latest patched versions for their respective branches. If patching cannot happen right away, external access to the /api/session/reset_password endpoint should be restricted via WAF or network controls. Administrators should also revoke all active sessions by clearing the core_session table.

Response

After detection, organizations must rotate all credentials for databases connected to Metabase within 24 hours. Security teams should perform threat hunting by reviewing Metabase activity logs, query history, and connected-database access logs for anomalous administrative actions. Teams must also validate whether the reset password endpoint is still reachable from untrusted networks.

Simulation Execution

• Attack Narrative & Commands: The attacker has identified a Metabase instance running on the target web server. Knowing that CVE-2026-72898 allows for unauthenticated SQL injection via the password reset flow, the attacker crafts a malicious POST request. The goal is to send a payload to the /api/session/reset_password endpoint that exploits the underlying database. This action is designed to trigger the detection rule by hitting the specific URI and method defined in the logic.

• Regression Test Script:

    #!/bin/bash
    # Simulation script for CVE-2026-72898 exploitation attempt
    # Target: Metabase /api/session/reset_password endpoint
  
    TARGET_URL="http://localhost/api/session/reset_password"
  
    echo "[+] Initiating simulated SQL injection attack via POST request..."
  
    # Sending a simulated malicious payload via POST
    # The payload is representative of an attempt to inject SQL into the password reset flow
    curl -X POST "$TARGET_URL" 
         -H "Content-Type: application/json" 
         -d '{"email": "admin@example.com", "new_password": "password''' OR 1=1 --"}'
  
    echo -e "n[+] Attack command sent. Check SIEM for detection of POST /api/session/reset_password"

• Cleanup Commands:

    # No permanent changes are made to the system by the curl command.
    # To clear Nginx logs for a clean state (use with caution in production):
    # sudo truncate -s 0 /var/log/nginx/access.log
    echo "[+] Cleanup complete. No artifacts left on target system."