Skip to content
Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898
bishopfox.com | vulnerability | CVE-2026-72898 | #sql-injection | #exploitation | #vulnerability | #metabase | #self-hosted | #unauthenticated | #cve-2026-72898
Summary
A critical unauthenticated SQL injection in Metabase's password reset endpoint (CVE-2026-72898, CVSS 10.0) allows arbitrary SQL against the application database; active exploitation is confirmed.
- Published
- Collected