--- title: Critical SQL Injection in Metabase via Password Reset:... description: A critical, unauthenticated SQL injection vulnerability (CVE-2026-72898, CVSS 10.0) has been disclosed in Metabase's password reset endpoint and is being... canonical: https://daily.dev/posts/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898-tvbzrtezo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898 | daily.dev og:description: A critical, unauthenticated SQL injection vulnerability (CVE-2026-72898, CVSS 10.0) has been disclosed in Metabase's password reset endpoint and is being... og:url: https://daily.dev/posts/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898-tvbzrtezo og:image: https://api.daily.dev/og/posts/tvbZRTeZo.png og:image:alt: Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898 **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 4 min read · 0 upvotes · 0 comments ## Summary A critical, unauthenticated SQL injection vulnerability (CVE-2026-72898, CVSS 10.0) has been disclosed in Metabase's password reset endpoint and is being actively exploited in the wild. The flaw stems from failure to restrict undeclared fields in the reset request body, letting attackers inject SQL into the application database and potentially gain full administrative access. Affected self-hosted versions span Metabase 58 through 63, with fixes available in 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5 or later. Immediate patching, credential audits, and log review are recommended. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-72898 in Metabase and how severe is it? CVE-2026-72898 is a critical, unauthenticated SQL injection vulnerability in Metabase's password reset endpoint (POST /api/session/reset_password), carrying a CVSS v3.1 score of 10.0. It stems from a failure to restrict undeclared fields in the request body, letting attackers inject SQL into the application-database query with no credentials or user interaction required. Metabase has confirmed active exploitation in the wild. _Track actively exploited vulnerabilities like this Metabase flaw on daily.dev before they hit your stack._ ### Which Metabase versions are affected by the password reset SQL injection and what version should I upgrade to? Affected branches are Metabase 58 through 63; patches are available in 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5 or later. Organizations running self-hosted Metabase should upgrade immediately to the patched release for their branch, since the vulnerability is unauthenticated and confirmed to be actively exploited. _Developers tracking patch cutoffs across dependencies rely on daily.dev to stay ahead of upgrades like this._ ### What can an attacker do after exploiting the Metabase reset_password SQL injection? Successful exploitation can let an attacker alter application-database records and gain full administrative access to Metabase. From there, they can change application settings, access or export data, obtain secrets available to the running application, and query any connected databases using Metabase's own privileges, since Metabase instances often hold credentials to the data warehouses they connect to. _Assessing blast radius after a critical CVE is easier when daily.dev keeps you current on incident details._ ## Similar posts on daily.dev - [August 2026 Security Vulnerability: What happened?](https://daily.dev/posts/august-2026-security-vulnerability-what-happened--vf4dqe4hg) · Metabase · 6 upvotes · 1 comments - [SQL Injection in Password Reset: Full Database, One Email](https://daily.dev/posts/sql-injection-in-password-reset-full-database-one-email-1gtafbmlb) · InfoSec Write-ups · 1 upvotes · 1 comments - [February 2026 vulnerability: What happened?](https://daily.dev/posts/february-2026-vulnerability-what-happened--9s3vxho4x) · Metabase · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql) [View this post on daily.dev](https://daily.dev/posts/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898-tvbzrtezo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898","url":"https://daily.dev/posts/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898-tvbzrtezo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898-tvbzrtezo"},"datePublished":"2026-08-23T12:22:31.705Z","dateModified":"2026-08-23T12:56:11.321Z","description":"A critical, unauthenticated SQL injection vulnerability (CVE-2026-72898, CVSS 10.0) has been disclosed in Metabase's password reset endpoint and is being...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898-tvbzrtezo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898-tvbzrtezo#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-72898 in Metabase and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-72898 is a critical, unauthenticated SQL injection vulnerability in Metabase's password reset endpoint (POST /api/session/reset_password), carrying a CVSS v3.1 score of 10.0. It stems from a failure to restrict undeclared fields in the request body, letting attackers inject SQL into the application-database query with no credentials or user interaction required. Metabase has confirmed active exploitation in the wild. Track actively exploited vulnerabilities like this Metabase flaw on daily.dev before they hit your stack."}},{"@type":"Question","name":"Which Metabase versions are affected by the password reset SQL injection and what version should I upgrade to?","acceptedAnswer":{"@type":"Answer","text":"Affected branches are Metabase 58 through 63; patches are available in 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5 or later. Organizations running self-hosted Metabase should upgrade immediately to the patched release for their branch, since the vulnerability is unauthenticated and confirmed to be actively exploited. Developers tracking patch cutoffs across dependencies rely on daily.dev to stay ahead of upgrades like this."}},{"@type":"Question","name":"What can an attacker do after exploiting the Metabase reset_password SQL injection?","acceptedAnswer":{"@type":"Answer","text":"Successful exploitation can let an attacker alter application-database records and gain full administrative access to Metabase. From there, they can change application settings, access or export data, obtain secrets available to the running application, and query any connected databases using Metabase's own privileges, since Metabase instances often hold credentials to the data warehouses they connect to. Assessing blast radius after a critical CVE is easier when daily.dev keeps you current on incident details."}}]} ```