--- title: Metabase SQLi exploit grants attackers total access description: Metabase has disclosed a critical zero-day SQL injection vulnerability (CVE-2026-72898) with a perfect CVSS score of 10, affecting versions 1.58 and up. The... canonical: https://daily.dev/posts/metabase-sqli-exploit-grants-attackers-total-access-sladwjvsz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Metabase SQLi exploit grants attackers total access | daily.dev og:description: Metabase has disclosed a critical zero-day SQL injection vulnerability (CVE-2026-72898) with a perfect CVSS score of 10, affecting versions 1.58 and up. The... og:url: https://daily.dev/posts/metabase-sqli-exploit-grants-attackers-total-access-sladwjvsz og:image: https://api.daily.dev/og/posts/sLadWjvSz.png og:image:alt: Metabase SQLi exploit grants attackers total access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Metabase SQLi exploit grants attackers total access **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary Metabase has disclosed a critical zero-day SQL injection vulnerability (CVE-2026-72898) with a perfect CVSS score of 10, affecting versions 1.58 and up. The exploit targets the /api/session/reset_password endpoint, granting attackers raw SQL access to Metabase's underlying database — enabling credential theft, privilege escalation, and data destruction. Roughly 2,500 Metabase instances are internet-exposed, and about 25% of self-hosted cloud deployments are fully accessible online. Several companies have already been breached, including Kilo Code, Tally, Framework, n8n, and ChecklyHQ, with stolen data including usernames, emails, API keys, and Slack tokens. Metabase Cloud customers are already patched; self-hosted users should upgrade immediately (e.g., from 0.58.6 to 0.58.24 or later) or block the vulnerable endpoint as a temporary workaround. Affected organizations should rotate all credentials, revoke sessions, audit admin accounts, and review query histories. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-72898 in Metabase and how severe is it? CVE-2026-72898 is a critical SQL injection zero-day in Metabase versions 1.58 and up, rated CVSS 10 — the highest possible score. The exploit targets the /api/session/reset_password endpoint and grants attackers unmitigated raw SQL access to Metabase's underlying database, enabling credential theft, privilege escalation, creation of rogue admin accounts, and data destruction. _Teams running self-hosted Metabase can track patch releases and incident updates on daily.dev as they drop._ ### How do I check if my Metabase instance was compromised by the SQLi exploit? Look for a specific two-request pattern in your application or ingress logs: a POST to /api/session/reset_password returning a 400 status code, immediately followed by a GET to /api/user/current returning 200. Metabase states that finding this pattern likely indicates compromise. If the endpoint was publicly accessible, revoke all sessions, audit admin accounts, rotate all connected database credentials, and review query histories. _Developers securing self-hosted analytics tools find breach indicators and remediation steps faster on daily.dev._ ### What is the patch version for the Metabase SQLi zero-day and what is the workaround if I can't upgrade immediately? Users running Metabase 0.58.6 should upgrade to 0.58.24 or later. For those unable to upgrade immediately, the temporary workaround is to block the /api/session/reset_password endpoint entirely. Metabase Cloud customers have already been patched automatically; only self-hosted deployments remain at risk if unpatched. _Engineers managing self-hosted Metabase upgrades can follow remediation coverage on daily.dev._ ## Similar posts on daily.dev - [August 2026 Security Vulnerability: What happened?](https://daily.dev/posts/august-2026-security-vulnerability-what-happened--vf4dqe4hg) · Metabase · 6 upvotes · 1 comments - [Security update available for Metabase - Please upgrade now](https://daily.dev/posts/security-update-available-for-metabase---please-upgrade-now-tsxl6886g) · Metabase · 6 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#bi](https://daily.dev/tags/bi), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/metabase-sqli-exploit-grants-attackers-total-access-sladwjvsz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Metabase SQLi exploit grants attackers total access","url":"https://daily.dev/posts/metabase-sqli-exploit-grants-attackers-total-access-sladwjvsz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/metabase-sqli-exploit-grants-attackers-total-access-sladwjvsz"},"datePublished":"2026-08-12T02:44:16.611Z","dateModified":"2026-08-12T02:45:27.573Z","description":"Metabase has disclosed a critical zero-day SQL injection vulnerability (CVE-2026-72898) with a perfect CVSS score of 10, affecting versions 1.58 and up. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5af9bee0d7c0ae97e00d098a47ed617f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5af9bee0d7c0ae97e00d098a47ed617f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/metabase-sqli-exploit-grants-attackers-total-access-sladwjvsz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,bi,zero-day","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Metabase SQLi exploit grants attackers total access"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/metabase-sqli-exploit-grants-attackers-total-access-sladwjvsz#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-72898 in Metabase and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-72898 is a critical SQL injection zero-day in Metabase versions 1.58 and up, rated CVSS 10 — the highest possible score. The exploit targets the /api/session/reset_password endpoint and grants attackers unmitigated raw SQL access to Metabase's underlying database, enabling credential theft, privilege escalation, creation of rogue admin accounts, and data destruction. Teams running self-hosted Metabase can track patch releases and incident updates on daily.dev as they drop."}},{"@type":"Question","name":"How do I check if my Metabase instance was compromised by the SQLi exploit?","acceptedAnswer":{"@type":"Answer","text":"Look for a specific two-request pattern in your application or ingress logs: a POST to /api/session/reset_password returning a 400 status code, immediately followed by a GET to /api/user/current returning 200. Metabase states that finding this pattern likely indicates compromise. If the endpoint was publicly accessible, revoke all sessions, audit admin accounts, rotate all connected database credentials, and review query histories. Developers securing self-hosted analytics tools find breach indicators and remediation steps faster on daily.dev."}},{"@type":"Question","name":"What is the patch version for the Metabase SQLi zero-day and what is the workaround if I can't upgrade immediately?","acceptedAnswer":{"@type":"Answer","text":"Users running Metabase 0.58.6 should upgrade to 0.58.24 or later. For those unable to upgrade immediately, the temporary workaround is to block the /api/session/reset_password endpoint entirely. Metabase Cloud customers have already been patched automatically; only self-hosted deployments remain at risk if unpatched. Engineers managing self-hosted Metabase upgrades can follow remediation coverage on daily.dev."}}]} ```