← back | CVE Intelligence

CVE-2026-72898

Curated 2 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-72898.

Coverage Span: 2026-08-06 → 2026-08-10
Reports: 2 related reports

Associated Reports & Timeline

Inside the Metabase SQLi: Exploited in the Wild

Wiz reverse-engineers CVE-2026-72898, the Metabase SQLi exploited in the wild via /api/session/reset_password since the Aug 6 incident; about 13% of cloud environments self-host Metabase.

Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898

A critical unauthenticated SQL injection in Metabase's password reset endpoint (CVE-2026-72898, CVSS 10.0) allows arbitrary SQL against the application database; active exploitation is confirmed.