Metabase flaw gives attackers administrator access
A Metabase flaw lets remote attackers become administrators without signing in. They can steal database credentials and read or export connected data.
- Severity
- Not scoredNo CVSS score recorded
- Fix
- Not confirmed
- Affects
- Metabase
- Exploited
- Yes, in the wild
How it works
- The attacker must be able to reach the vulnerable Metabase service remotely.
- They send a crafted request to its password-reset service without signing in.
- This makes Metabase run attacker-chosen instructions against its application database.
- The attacker can then gain administrator access, steal credentials, and access connected data.
What to do
Compare your installed Metabase release with the affected ranges. Search application or ingress logs for a password-reset request returning 400, followed by a current-user request returning 200. Metabase says this pattern likely means the instance was compromised.
Install x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, or x.63.5 for your branch. Until then, block access to /api/session/reset_password. If that endpoint was publicly accessible, revoke active sessions after updating. Also inspect administrator accounts and API keys, rotate connected database credentials, and review query and warehouse logs.
Technical details
Framework alerted customers that names, addresses, phone numbers, emails, and login IPs were accessed. N8n reported that an attacker obtained 136 customer records through its Metabase environment.
CVE-2026-72898 is a remotely exploitable SQL injection flaw in /api/session/reset_password. It lets an unauthenticated attacker issue database instructions and gain Metabase administrator access. The flaw was exploited before patches were available. Administrator access can expose Metabase configuration, stored connection credentials, and data reachable through connected databases.