---
id: 6509
title: "Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898"
cve: CVE-2026-72898
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898"
published_at: "2026-08-06T00:00:00Z"
tags: ["sql-injection", "exploitation", "vulnerability", "metabase", "self-hosted", "unauthenticated", "cve-2026-72898"]
phying_url: "https://phying.com/item/6509"
lang: en
---

# Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898

## Summary

A critical unauthenticated SQL injection in Metabase's password reset endpoint (CVE-2026-72898, CVSS 10.0) allows arbitrary SQL against the application database; active exploitation is confirmed.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-72898
- **Published:** 2026-08-06T00:00:00Z
- **Original:** https://bishopfox.com/blog/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898
- **Phying News:** https://phying.com/item/6509