{"vulnerability": "cve-2026-72898", "sightings": [{"uuid": "6d66573b-b58f-4da2-a080-2738588b2be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/117072531713464991", "content": "Since Metabase couldn't be bothered, it looks like CISA has assigned CVEs.\n\nCVE-2026-72898 Metabase SQL injection via password reset endpoint\nCVE-2026-72899 Metabase SQL injection via public card or dashboard\nCVE-2026-72900", "creation_timestamp": "2026-08-10T18:04:27.786996Z"}, {"uuid": "95da889d-b37f-4845-ab2a-ea329ca50f4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3msqorw2bpc22", "content": "Since Metabase couldn't be bothered, it looks like CISA has assigned CVEs.\n\n  * CVE-2026-72898 Metabase SQL injection via password reset endpoint\n  * CVE-2026-72899 Metabase SQL injection via public card or dashboard\n  * CVE-2026-72900\n\n", "creation_timestamp": "2026-08-10T18:04:38.372887Z"}, {"uuid": "2f499ed1-e1c2-4e7b-85ca-f60db5970aeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/h2ggpjbkjd3mt", "content": "CVE-2026-72898 - Metabase SQL injection via password reset endpoint\nCVE ID : CVE-2026-72898\n \n Published : Aug. 10, 2026, 6:18 p.m. | 11\u00a0minutes ago\n \n Description : Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database e...", "creation_timestamp": "2026-08-10T18:56:56.616870Z"}, {"uuid": "767e1052-8fcf-471b-89c1-eacad1aeb62a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msqtdoplmw2o", "content": "CVE-2026-72898\nMetabase's reset password feature can be exploited by an attacker to inject malicious SQL code, potentially gaining administrator access to the connected database. This vulnerability allows an attacker to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-10T19:26:06.295479Z"}, {"uuid": "bb5453e6-ab34-46e6-8b28-f7bb80c997a2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/80ebf1f6-0e2d-47d9-8e7d-dbef120a1e0f", "content": "", "creation_timestamp": "2026-08-10T21:00:26.046615Z"}]}