Vulnerability-Lookup

VA-26-222-01

Vulnerability from csaf_cisa - Published: 2026-08-10 17:55 - Updated: 2026-08-10 17:55

Summary

Metabase SQL injection

Notes

Legal Notice: All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).

Countries and Areas Deployed: Worldwide

Critical Infrastructure Sectors: Information Technology

Risk Evaluation: Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL. In the worst case an attacker could gain administrative privileges.

Recommended Practices: Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5. See https://www.metabase.com/blog/security-update.

Company Headquarters Location: United States

CVE-2026-72898

10.0 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Known affected 6 products

Product	Version	Remediation
Metabase Metabase >=x.58.0\|<x.58.24 Metabase / Metabase	>=x.58.0\|<x.58.24	Vendor Fix fix
Metabase Metabase >=x.59.0\|<x.59.21 Metabase / Metabase	>=x.59.0\|<x.59.21	Vendor Fix fix
Metabase Metabase >=x.60.0\|<x.60.17 Metabase / Metabase	>=x.60.0\|<x.60.17	Vendor Fix fix
Metabase Metabase >=x.61.0\|<x.61.11 Metabase / Metabase	>=x.61.0\|<x.61.11	Vendor Fix fix
Metabase Metabase >=x.62.0\|<x.62.9 Metabase / Metabase	>=x.62.0\|<x.62.9	Vendor Fix fix
Metabase Metabase >=x.63.0\|<x.63.5 Metabase / Metabase	>=x.63.0\|<x.63.5	Vendor Fix fix

Fixed 6 products

Product	Version	Remediation
Metabase Metabase x.58.24 Metabase / Metabase	x.58.24	Vendor Fix fix
Metabase Metabase x.59.21 Metabase / Metabase	x.59.21	Vendor Fix fix
Metabase Metabase x.60.17 Metabase / Metabase	x.60.17	Vendor Fix fix
Metabase Metabase x.61.11 Metabase / Metabase	x.61.11	Vendor Fix fix
Metabase Metabase x.62.9 Metabase / Metabase	x.62.9	Vendor Fix fix
Metabase Metabase x.63.5 Metabase / Metabase	x.63.5	Vendor Fix fix

CVE-2026-72899

10.0 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Known affected 6 products

Product	Version	Remediation
Metabase Metabase >=x.58.0\|<x.58.24 Metabase / Metabase	>=x.58.0\|<x.58.24	Vendor Fix fix
Metabase Metabase >=x.59.0\|<x.59.21 Metabase / Metabase	>=x.59.0\|<x.59.21	Vendor Fix fix
Metabase Metabase >=x.60.0\|<x.60.17 Metabase / Metabase	>=x.60.0\|<x.60.17	Vendor Fix fix
Metabase Metabase >=x.61.0\|<x.61.11 Metabase / Metabase	>=x.61.0\|<x.61.11	Vendor Fix fix
Metabase Metabase >=x.62.0\|<x.62.9 Metabase / Metabase	>=x.62.0\|<x.62.9	Vendor Fix fix
Metabase Metabase >=x.63.0\|<x.63.5 Metabase / Metabase	>=x.63.0\|<x.63.5	Vendor Fix fix

Fixed 6 products

Product	Version	Remediation
Metabase Metabase x.58.24 Metabase / Metabase	x.58.24	Vendor Fix fix
Metabase Metabase x.59.21 Metabase / Metabase	x.59.21	Vendor Fix fix
Metabase Metabase x.60.17 Metabase / Metabase	x.60.17	Vendor Fix fix
Metabase Metabase x.61.11 Metabase / Metabase	x.61.11	Vendor Fix fix
Metabase Metabase x.62.9 Metabase / Metabase	x.62.9	Vendor Fix fix
Metabase Metabase x.63.5 Metabase / Metabase	x.63.5	Vendor Fix fix

CVE-2026-72900

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-862 - Missing Authorization

Affected products

Known affected 6 products

Product	Version	Remediation
Metabase Metabase >=x.58.0\|<x.58.24 Metabase / Metabase	>=x.58.0\|<x.58.24	Vendor Fix fix
Metabase Metabase >=x.59.0\|<x.59.21 Metabase / Metabase	>=x.59.0\|<x.59.21	Vendor Fix fix
Metabase Metabase >=x.60.0\|<x.60.17 Metabase / Metabase	>=x.60.0\|<x.60.17	Vendor Fix fix
Metabase Metabase >=x.61.0\|<x.61.11 Metabase / Metabase	>=x.61.0\|<x.61.11	Vendor Fix fix
Metabase Metabase >=x.62.0\|<x.62.9 Metabase / Metabase	>=x.62.0\|<x.62.9	Vendor Fix fix
Metabase Metabase >=x.63.0\|<x.63.5 Metabase / Metabase	>=x.63.0\|<x.63.5	Vendor Fix fix

Fixed 6 products

Product	Version	Remediation
Metabase Metabase x.58.24 Metabase / Metabase	x.58.24	Vendor Fix fix
Metabase Metabase x.59.21 Metabase / Metabase	x.59.21	Vendor Fix fix
Metabase Metabase x.60.17 Metabase / Metabase	x.60.17	Vendor Fix fix
Metabase Metabase x.61.11 Metabase / Metabase	x.61.11	Vendor Fix fix
Metabase Metabase x.62.9 Metabase / Metabase	x.62.9	Vendor Fix fix
Metabase Metabase x.63.5 Metabase / Metabase	x.63.5	Vendor Fix fix

References

9 references

URL	Category
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://github.com/metabase/metabase/security/adv…	external
https://www.metabase.com/blog/security-update	external
https://www.cve.org/CVERecord?id=CVE-2026-72898	external
https://raw.githubusercontent.com/cisagov/CSAF/de…	external
https://github.com/metabase/metabase/security/adv…	external
https://www.cve.org/CVERecord?id=CVE-2026-72899	external
https://github.com/metabase/metabase/security/adv…	external
https://www.cve.org/CVERecord?id=CVE-2026-72900	external

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL. In the worst case an attacker could gain administrative privileges.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5. See https://www.metabase.com/blog/security-update.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-26-222-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
      }
    ],
    "title": "Metabase SQL injection",
    "tracking": {
      "current_release_date": "2026-08-10T17:55:37Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.101"
        }
      },
      "id": "VA-26-222-01",
      "initial_release_date": "2026-08-10T17:55:37Z",
      "revision_history": [
        {
          "date": "2026-08-10T17:55:37Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=x.58.0|\u003cx.58.24",
                "product": {
                  "name": "Metabase Metabase \u003e=x.58.0|\u003cx.58.24",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "x.58.24",
                "product": {
                  "name": "Metabase Metabase x.58.24",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.59.0|\u003cx.59.21",
                "product": {
                  "name": "Metabase Metabase \u003e=x.59.0|\u003cx.59.21",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "x.59.21",
                "product": {
                  "name": "Metabase Metabase x.59.21",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.60.0|\u003cx.60.17",
                "product": {
                  "name": "Metabase Metabase \u003e=x.60.0|\u003cx.60.17",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "x.60.17",
                "product": {
                  "name": "Metabase Metabase x.60.17",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.61.0|\u003cx.61.11",
                "product": {
                  "name": "Metabase Metabase \u003e=x.61.0|\u003cx.61.11",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "x.61.11",
                "product": {
                  "name": "Metabase Metabase x.61.11",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.62.0|\u003cx.62.9",
                "product": {
                  "name": "Metabase Metabase \u003e=x.62.0|\u003cx.62.9",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "x.62.9",
                "product": {
                  "name": "Metabase Metabase x.62.9",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.63.0|\u003cx.63.5",
                "product": {
                  "name": "Metabase Metabase \u003e=x.63.0|\u003cx.63.5",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "x.63.5",
                "product": {
                  "name": "Metabase Metabase x.63.5",
                  "product_id": "CSAFPID-0012"
                }
              }
            ],
            "category": "product_name",
            "name": "Metabase"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=x.58.0|\u003cx.58.24",
                "product": {
                  "name": "Metabase Metabase \u003e=x.58.0|\u003cx.58.24",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version",
                "name": "x.58.24",
                "product": {
                  "name": "Metabase Metabase x.58.24",
                  "product_id": "CSAFPID-0014"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.59.0|\u003cx.59.21",
                "product": {
                  "name": "Metabase Metabase \u003e=x.59.0|\u003cx.59.21",
                  "product_id": "CSAFPID-0015"
                }
              },
              {
                "category": "product_version",
                "name": "x.59.21",
                "product": {
                  "name": "Metabase Metabase x.59.21",
                  "product_id": "CSAFPID-0016"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.60.0|\u003cx.60.17",
                "product": {
                  "name": "Metabase Metabase \u003e=x.60.0|\u003cx.60.17",
                  "product_id": "CSAFPID-0017"
                }
              },
              {
                "category": "product_version",
                "name": "x.60.17",
                "product": {
                  "name": "Metabase Metabase x.60.17",
                  "product_id": "CSAFPID-0018"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.61.0|\u003cx.61.11",
                "product": {
                  "name": "Metabase Metabase \u003e=x.61.0|\u003cx.61.11",
                  "product_id": "CSAFPID-0019"
                }
              },
              {
                "category": "product_version",
                "name": "x.61.11",
                "product": {
                  "name": "Metabase Metabase x.61.11",
                  "product_id": "CSAFPID-0020"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.62.0|\u003cx.62.9",
                "product": {
                  "name": "Metabase Metabase \u003e=x.62.0|\u003cx.62.9",
                  "product_id": "CSAFPID-0021"
                }
              },
              {
                "category": "product_version",
                "name": "x.62.9",
                "product": {
                  "name": "Metabase Metabase x.62.9",
                  "product_id": "CSAFPID-0022"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.63.0|\u003cx.63.5",
                "product": {
                  "name": "Metabase Metabase \u003e=x.63.0|\u003cx.63.5",
                  "product_id": "CSAFPID-0023"
                }
              },
              {
                "category": "product_version",
                "name": "x.63.5",
                "product": {
                  "name": "Metabase Metabase x.63.5",
                  "product_id": "CSAFPID-0024"
                }
              }
            ],
            "category": "product_name",
            "name": "Metabase"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=x.58.0|\u003cx.58.24",
                "product": {
                  "name": "Metabase Metabase \u003e=x.58.0|\u003cx.58.24",
                  "product_id": "CSAFPID-0025"
                }
              },
              {
                "category": "product_version",
                "name": "x.58.24",
                "product": {
                  "name": "Metabase Metabase x.58.24",
                  "product_id": "CSAFPID-0026"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.59.0|\u003cx.59.21",
                "product": {
                  "name": "Metabase Metabase \u003e=x.59.0|\u003cx.59.21",
                  "product_id": "CSAFPID-0027"
                }
              },
              {
                "category": "product_version",
                "name": "x.59.21",
                "product": {
                  "name": "Metabase Metabase x.59.21",
                  "product_id": "CSAFPID-0028"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.60.0|\u003cx.60.17",
                "product": {
                  "name": "Metabase Metabase \u003e=x.60.0|\u003cx.60.17",
                  "product_id": "CSAFPID-0029"
                }
              },
              {
                "category": "product_version",
                "name": "x.60.17",
                "product": {
                  "name": "Metabase Metabase x.60.17",
                  "product_id": "CSAFPID-0030"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.61.0|\u003cx.61.11",
                "product": {
                  "name": "Metabase Metabase \u003e=x.61.0|\u003cx.61.11",
                  "product_id": "CSAFPID-0031"
                }
              },
              {
                "category": "product_version",
                "name": "x.61.11",
                "product": {
                  "name": "Metabase Metabase x.61.11",
                  "product_id": "CSAFPID-0032"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.62.0|\u003cx.62.9",
                "product": {
                  "name": "Metabase Metabase \u003e=x.62.0|\u003cx.62.9",
                  "product_id": "CSAFPID-0033"
                }
              },
              {
                "category": "product_version",
                "name": "x.62.9",
                "product": {
                  "name": "Metabase Metabase x.62.9",
                  "product_id": "CSAFPID-0034"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=x.63.0|\u003cx.63.5",
                "product": {
                  "name": "Metabase Metabase \u003e=x.63.0|\u003cx.63.5",
                  "product_id": "CSAFPID-0035"
                }
              },
              {
                "category": "product_version",
                "name": "x.63.5",
                "product": {
                  "name": "Metabase Metabase x.63.5",
                  "product_id": "CSAFPID-0036"
                }
              }
            ],
            "category": "product_name",
            "name": "Metabase"
          }
        ],
        "category": "vendor",
        "name": "Metabase"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-72898",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the \u0027/reset_password\u0027 database endpoint and gain administrator access to the connected Metabase instance.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:A/A:Y/T:T/2026-08-10T17:14:52Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf"
        },
        {
          "category": "external",
          "summary": "www.metabase.com",
          "url": "https://www.metabase.com/blog/security-update"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
        }
      ],
      "release_date": "2026-08-06T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0012"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0011"
          ]
        }
      ],
      "title": "Metabase SQL injection via password reset endpoint"
    },
    {
      "cve": "CVE-2026-72899",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:T/2026-08-10T17:19:15Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72899"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
        }
      ],
      "release_date": "2026-08-06T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0012"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0011"
          ]
        }
      ],
      "title": "Metabase SQL injection via public card or dashboard"
    },
    {
      "cve": "CVE-2026-72900",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-08-10T17:20:03Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72900"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
        }
      ],
      "release_date": "2026-08-06T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        },
        {
          "category": "vendor_fix",
          "date": "2026-08-06T00:00:00Z",
          "details": "Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5.",
          "product_ids": [
            "CSAFPID-0012"
          ],
          "url": "https://github.com/metabase/metabase/releases"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0011"
          ]
        }
      ],
      "title": "Metabase information exposure"
    }
  ]
}

CVE-2026-72898 (GCVE-0-2026-72898)

Vulnerability from cvelistv5 – Published: 2026-08-10 17:55 – Updated: 2026-08-11 03:55

Title

Metabase SQL injection via password reset endpoint

Summary

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Severity

10 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

cisa-cg

References

4 references

URL	Tags
https://github.com/metabase/metabase/security/adv…	vendor-advisory
https://www.metabase.com/blog/security-update	vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-72898	vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/de…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Metabase	Metabase	Affected: x.58.0 , < x.58.24 (custom) Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5

Date Public

2026-08-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T03:55:37.321Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Metabase",
          "vendor": "Metabase",
          "versions": [
            {
              "lessThan": "x.58.24",
              "status": "affected",
              "version": "x.58.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.58.24"
            },
            {
              "lessThan": "x.59.21",
              "status": "affected",
              "version": "x.59.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.59.21"
            },
            {
              "lessThan": "x.60.17",
              "status": "affected",
              "version": "x.60.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.60.17"
            },
            {
              "lessThan": "x.61.11",
              "status": "affected",
              "version": "x.61.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.61.11"
            },
            {
              "lessThan": "x.62.9",
              "status": "affected",
              "version": "x.62.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.62.9"
            },
            {
              "lessThan": "x.63.5",
              "status": "affected",
              "version": "x.63.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.63.5"
            }
          ]
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the \u0027/reset_password\u0027 database endpoint and gain administrator access to the connected Metabase instance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-72898",
              "options": [
                {
                  "Exploitation": "active"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-08-10T17:14:52.872411Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T17:55:54.841Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf"
        },
        {
          "name": "url",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.metabase.com/blog/security-update"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
        }
      ],
      "title": "Metabase SQL injection via password reset endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-72898",
    "datePublished": "2026-08-10T17:55:54.841Z",
    "dateReserved": "2026-08-10T17:20:39.650Z",
    "dateUpdated": "2026-08-11T03:55:37.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72899 (GCVE-0-2026-72899)

Vulnerability from cvelistv5 – Published: 2026-08-10 17:56 – Updated: 2026-08-11 03:55

Title

Metabase SQL injection via public card or dashboard

Summary

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

cisa-cg

References

3 references

URL	Tags
https://github.com/metabase/metabase/security/adv…	vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-72899	vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/de…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Metabase	Metabase	Affected: x.58.0 , < x.58.24 (custom) Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5

Date Public

2026-08-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T03:55:38.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Metabase",
          "vendor": "Metabase",
          "versions": [
            {
              "lessThan": "x.58.24",
              "status": "affected",
              "version": "x.58.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.58.24"
            },
            {
              "lessThan": "x.59.21",
              "status": "affected",
              "version": "x.59.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.59.21"
            },
            {
              "lessThan": "x.60.17",
              "status": "affected",
              "version": "x.60.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.60.17"
            },
            {
              "lessThan": "x.61.11",
              "status": "affected",
              "version": "x.61.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.61.11"
            },
            {
              "lessThan": "x.62.9",
              "status": "affected",
              "version": "x.62.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.62.9"
            },
            {
              "lessThan": "x.63.5",
              "status": "affected",
              "version": "x.63.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.63.5"
            }
          ]
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-72899",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-08-10T17:19:15.173020Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T17:56:09.950Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72899"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
        }
      ],
      "title": "Metabase SQL injection via public card or dashboard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-72899",
    "datePublished": "2026-08-10T17:56:09.950Z",
    "dateReserved": "2026-08-10T17:21:11.759Z",
    "dateUpdated": "2026-08-11T03:55:38.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72900 (GCVE-0-2026-72900)

Vulnerability from cvelistv5 – Published: 2026-08-10 17:56 – Updated: 2026-08-10 20:04

Title

Metabase information exposure

Summary

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

cisa-cg

References

3 references

URL	Tags
https://github.com/metabase/metabase/security/adv…	vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2026-72900	vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/de…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Metabase	Metabase	Affected: x.58.0 , < x.58.24 (custom) Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5

Date Public

2026-08-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72900",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T20:04:25.578746Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T20:04:45.028Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Metabase",
          "vendor": "Metabase",
          "versions": [
            {
              "lessThan": "x.58.24",
              "status": "affected",
              "version": "x.58.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.58.24"
            },
            {
              "lessThan": "x.59.21",
              "status": "affected",
              "version": "x.59.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.59.21"
            },
            {
              "lessThan": "x.60.17",
              "status": "affected",
              "version": "x.60.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.60.17"
            },
            {
              "lessThan": "x.61.11",
              "status": "affected",
              "version": "x.61.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.61.11"
            },
            {
              "lessThan": "x.62.9",
              "status": "affected",
              "version": "x.62.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.62.9"
            },
            {
              "lessThan": "x.63.5",
              "status": "affected",
              "version": "x.63.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "x.63.5"
            }
          ]
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-72900",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-08-10T17:20:03.619417Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T17:56:23.099Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72900"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
        }
      ],
      "title": "Metabase information exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-72900",
    "datePublished": "2026-08-10T17:56:23.099Z",
    "dateReserved": "2026-08-10T17:21:18.799Z",
    "dateUpdated": "2026-08-10T20:04:45.028Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Product	Version	Remediation
Metabase Metabase >=x.58.0\|<x.58.24 Metabase / Metabase	>=x.58.0\|<x.58.24	Vendor Fix fix
Metabase Metabase >=x.59.0\|<x.59.21 Metabase / Metabase	>=x.59.0\|<x.59.21	Vendor Fix fix
Metabase Metabase >=x.60.0\|<x.60.17 Metabase / Metabase	>=x.60.0\|<x.60.17	Vendor Fix fix
Metabase Metabase >=x.61.0\|<x.61.11 Metabase / Metabase	>=x.61.0\|<x.61.11	Vendor Fix fix
Metabase Metabase >=x.62.0\|<x.62.9 Metabase / Metabase	>=x.62.0\|<x.62.9	Vendor Fix fix
Metabase Metabase >=x.63.0\|<x.63.5 Metabase / Metabase	>=x.63.0\|<x.63.5	Vendor Fix fix

Product	Version	Remediation
Metabase Metabase >=x.58.0\|<x.58.24 Metabase / Metabase	>=x.58.0\|<x.58.24	Vendor Fix fix
Metabase Metabase >=x.59.0\|<x.59.21 Metabase / Metabase	>=x.59.0\|<x.59.21	Vendor Fix fix
Metabase Metabase >=x.60.0\|<x.60.17 Metabase / Metabase	>=x.60.0\|<x.60.17	Vendor Fix fix
Metabase Metabase >=x.61.0\|<x.61.11 Metabase / Metabase	>=x.61.0\|<x.61.11	Vendor Fix fix
Metabase Metabase >=x.62.0\|<x.62.9 Metabase / Metabase	>=x.62.0\|<x.62.9	Vendor Fix fix
Metabase Metabase >=x.63.0\|<x.63.5 Metabase / Metabase	>=x.63.0\|<x.63.5	Vendor Fix fix

Product	Version	Remediation
Metabase Metabase >=x.58.0\|<x.58.24 Metabase / Metabase	>=x.58.0\|<x.58.24	Vendor Fix fix
Metabase Metabase >=x.59.0\|<x.59.21 Metabase / Metabase	>=x.59.0\|<x.59.21	Vendor Fix fix
Metabase Metabase >=x.60.0\|<x.60.17 Metabase / Metabase	>=x.60.0\|<x.60.17	Vendor Fix fix
Metabase Metabase >=x.61.0\|<x.61.11 Metabase / Metabase	>=x.61.0\|<x.61.11	Vendor Fix fix
Metabase Metabase >=x.62.0\|<x.62.9 Metabase / Metabase	>=x.62.0\|<x.62.9	Vendor Fix fix
Metabase Metabase >=x.63.0\|<x.63.5 Metabase / Metabase	>=x.63.0\|<x.63.5	Vendor Fix fix

Action not permitted

VA-26-222-01

CVE-2026-72898 (GCVE-0-2026-72898)

CVE-2026-72899 (GCVE-0-2026-72899)

CVE-2026-72900 (GCVE-0-2026-72900)

Tags

Sightings

Nomenclature