Skip to content

CVE-2026-72898 Deep Dive: Unauthenticated SQL Injection in Metabase Leading to Admin Takeover

A critical unauthenticated SQL injection vulnerability, tracked as CVE-2026-72898, has been identified and actively exploited in Metabase, the popular open-source business intelligence platform. This flaw, rated with a CVSS score of 10.0 (Critical), allows remote, unauthenticated attackers to achieve administrator access to Metabase instances, potentially compromising sensitive data and connected databases.

Executive Summary

Metabase has confirmed active exploitation of CVE-2026-72898 in the wild as a zero-day. The vulnerability stems from improper handling of user-supplied input in the password-reset functionality, specifically within the /api/session/reset_password endpoint. Exploitation requires no authentication or user interaction, making it a highly attractive target for adversaries. Successful compromise grants full administrative control over the Metabase instance, including the ability to exfiltrate credentials for connected data sources and access underlying data.

Vulnerability Details

  • CVE ID: CVE-2026-72898
  • CWE: CWE-89: Improper Neutralization of Special Elements in an SQL Command ('SQL Injection')
  • Vendor: Metabase
  • Affected Products/Versions:
    • Metabase 0.58.0 through 0.58.23 (Enterprise 1.58.0 through 1.58.23)
    • Metabase 0.59.0 through 0.59.20 (Enterprise 1.59.0 through 1.59.20)
    • Metabase 0.60.0 through 0.60.16 (Enterprise 1.60.0 through 1.60.16)
    • Metabase 0.61.0 through 0.61.10 (Enterprise 1.61.0 through 1.61.10)
    • Metabase 0.62.0 through 0.62.8 (Enterprise 1.62.0 through 1.62.8)
    • Metabase 0.63.0 through 0.63.3 (Enterprise 1.63.0 through 1.63.3)
  • Patched Versions:
    • 0.58.24 / 1.58.24
    • 0.59.21 / 1.59.21
    • 0.60.17 / 1.60.17
    • 0.61.11 / 1.61.11
    • 0.62.9 / 1.62.9
    • 0.63.5 / 1.63.5
  • CVSS v3.1 Base Score: 10.0 (Critical)
    • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Technical Root Cause Analysis

The vulnerability lies in the way Metabase's Clojure-based backend processes JSON input, specifically when handling the user-id parameter during the password reset flow. The core issues that combine to create this SQL injection are:

  1. Clojure's merge function: When processing the POST /api/session/reset_password request, the request map is merged with the authentication result. If authentication fails, the user-id key (if present) from the initial request is not stripped and passes through untouched.
  2. JSON Keywordization: JSON keys in the payload are converted into Clojure keywords. An attacker can craft a payload like {"user-id": {"raw": "SQL_PAYLOAD"}}.
  3. HoneySQL's :raw keyword: Metabase uses HoneySQL for building SQL queries. The :raw keyword in HoneySQL is designed to allow developers to embed literal SQL strings, bypassing parameterization. When the attacker-controlled {"raw": "SQL_PAYLOAD"} value reaches a HoneySQL query that expects an integer user-id, it is interpreted as a directive to inject the SQL string directly.
  4. Injection Execution: This manipulated user-id value is then passed to t2/select-one :id user-id, causing the embedded SQL payload to be executed within the Metabase application database.

This confluence of factors allows an attacker to bypass intended input validation and achieve arbitrary blind SQL injection. The specific database backend (H2, PostgreSQL, MySQL, MariaDB) will determine the exact SQL injection payload.

Impact

A successful exploitation of CVE-2026-72898 grants an unauthenticated attacker full administrative access to the Metabase instance. This can lead to:

  • Complete Data Compromise: Access and exfiltration of all data accessible through Metabase's connected databases.
  • Credential Theft: Theft of stored credentials for all configured data sources.
  • System Alteration: Ability to modify Metabase configuration, pivot to other internal systems, and establish persistence.
  • Operational Disruption: Denial of service or data manipulation.

Given Metabase's role as a business intelligence platform often connected to critical organizational data, the impact is severe, leading to high confidentiality, integrity, and availability compromise.

Proof-of-Concept (PoC)

While full exploitation details can be complex and depend on the underlying database, the core injection mechanism can be demonstrated via the /api/session/reset_password endpoint.

Below is a curl command illustrating the structure of the malicious request. An attacker would replace SQL_PAYLOAD with a crafted SQL query relevant to the target database (e.g., extracting administrator hashes, creating new admin users, or modifying existing user roles).

curl -X POST https://[METABASE_TARGET]/api/session/reset_password \
-H "Content-Type: application/json" \
-d '{"token":"x","password":"y","user-id":{"raw":"SQL_PAYLOAD"}}'

Example (Hypothetical, for illustrative purposes - payload must be carefully crafted per database): To potentially extract sensitive information or enumerate users in a PostgreSQL backend, a blind SQL injection might involve timing-based payloads or error-based techniques if the application's error handling provides feedback. For instance, to test for injectability:

-- Blind SQL Injection example payload (conceptual)
-- This would need to be adapted for specific database and desired outcome
(SELECT pg_sleep(5) FROM pg_database WHERE current_user = 'metabase')

The actual payload would be URI-encoded and carefully constructed to fit within the JSON structure and then executed by the database.

Detection & Mitigation

Detection

  • Logs: Monitor Metabase access logs for unusual activity on the /api/session/reset_password endpoint, especially POST requests with suspicious JSON bodies containing user-id and raw keywords or excessive requests from unknown IPs.
  • Network Intrusion Detection Systems (NIDS): Look for POST requests to /api/session/reset_password containing patterns indicative of SQL injection payloads.
  • Database Logs: Monitor the Metabase application database for unusual queries, especially those attempting to create new users, modify permissions, or extract large amounts of data from unexpected sources.

Mitigation

  1. Immediate Patching: Upgrade Metabase instances to the latest patched versions as soon as possible.
  2. Temporary Workaround: If immediate patching is not possible, block access to the /api/session/reset_password endpoint at the network or web application firewall (WAF) level.
  3. Post-Patching Actions (CRITICAL):
    • Revoke all active user sessions: Delete all rows in the core_session table in the Metabase application database.
    • Review API keys: Delete any unrecognized API keys.
    • Review administrator accounts: Check for any unauthorized changes or newly created admin accounts.
    • Rotate Credentials: Rotate credentials for any databases connected to Metabase, as these may have been compromised.
    • Audit Logs: Thoroughly review Metabase activity logs and query history for any signs of unauthorized access or suspicious behavior.

Conclusion

CVE-2026-72898 represents a severe threat to Metabase deployments, particularly due to its unauthenticated nature and active exploitation. Organizations using Metabase must prioritize patching and follow post-remediation steps to ensure full recovery and prevent further compromise. Continuous monitoring and a robust incident response plan are essential for defending against such critical zero-day vulnerabilities.

References

Comments (0)

Loading comments...