Metabase SQL Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-08-11
• EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 10.0
• Urgent advisory from CERT-FR

[ Description ]Official description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CISA: Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 14 Aug 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

• Security bulletin: MetabaseVendor patch or bulletin · CERT-FR · github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf, cited by CERT-FR CERTFR-2026-ALE-010
• Blog post by MetabaseVendor patch or bulletin · CERT-FR · metabase.com/blog/vulnerability-what-happened, cited by CERT-FR CERTFR-2026-ALE-010
• Blog post by MetabaseVendor patch or bulletin · CERT-FR · metabase.com/blog/security-update-6-aug-2026, cited by CERT-FR CERTFR-2026-ALE-010
• Patch on metabase.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• CERT-FR10 Sep 2026CERTFR-2026-ALE-010

  Vulnerability in Metabase Translated from French

  On 6 August 2026, Metabase published a security advisory about a critical vulnerability that allows an unauthenticated attacker to cause SQL injection (SQLi) in the Metabase application database. This SQL injection…

  AlertCVE-2026-72898

[ References ]References

• github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjfMitigationPatchVendor Advisory
• raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.jsonThird Party Advisory
• www.cve.org/CVERecordVDB Entry
• www.metabase.com/blog/security-updateMitigationPatchVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource