CVE-2026-72898: Metabase Unauthenticated SQL Injection Remediation

Metabase open-source 0.58–0.63 and Enterprise 1.58–1.63 trains before the patched releases below allow a remote unauthenticated attacker to inject SQL into the Metabase application database through the password-reset surface. Successful injection can grant administrator access. From there an attacker can change application configuration, steal stored warehouse credentials, read data reachable through those connections, and export results.

Metabase confirmed active exploitation. CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog on 2026-08-11 (required action due 2026-08-14). If /api/session/reset_password was publicly reachable on a vulnerable version, treat the instance as an incident: revoke sessions, review administrators and API keys, and rotate connected-database credentials after the upgrade.

Do not prove exposure by sending SQL, resetting passwords, or querying the application database as an attacker. Inventory versions and ingress; then patch.

When to use it

• A repository deploys, images, charts, or documents Metabase OSS 0.58–0.63 or Enterprise 1.58–1.63 below the patched releases.
• Metabase is reachable through public ingress, reverse proxies, tunnels, or shared preview environments.
• You need a bounded PR that upgrades Metabase, blocks password-reset during rollout, and documents incident cleanup after public exposure.

Inputs

• Compose/Helm/Kubernetes/Terraform manifests, container images, version pins, gateway/proxy config, environment templates, SBOMs, and runbooks.
• Metabase edition (OSS 0.x vs Enterprise 1.x), exact version, public hostname, password-reset route exposure, application-database owner, and credential rotation owners.
• Available image rebuild, deployment render, gateway policy, SBOM, and dependency/security scan commands.

Affected versions

Use the patched release on the same major train. Do not jump trains unless product owners accept that migration.

• Temporary containment: block /api/session/reset_password at the edge until every instance is patched. This is not a substitute for the upgrade.
• Live GHAD: /advisories/GHSA-vwf4-m7j8-wcjf is 404. The metabase/metabase repo advisory still exists and lists some affected upper bounds below the patched release (for example first_patched x.58.24 versus range < x.58.23).
• Fixed / NVD CPE: NVD excludes 0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5 and matching Enterprise 1.x. Do not infer safety from the repo gap; install the NVD-excluded patched release. Do not invent a later floor.
• Weakness: CWE-89 SQL injection.
• CISA KEV: yes; added 2026-08-11 with required action due 2026-08-14.

Indicator-of-exposure

• Metabase resolves to a vulnerable 0.58–0.63 or 1.58–1.63 build.
• HTTP(S) clients outside a trusted admin network can reach the Metabase UI or /api/session/reset_password.
• Password reset is enabled on a network-exposed instance.

Quick checks:

rg -n "metabase|MB_VERSION|/api/session/reset_password" .
docker images | rg -i "metabase"

Windows:

rg -n "metabase|MB_VERSION|/api/session/reset_password" .
docker images | rg -i "metabase"

Do not send requests to /api/session/reset_password, craft SQL, or inspect production core_session rows during reconnaissance.

Remediation strategy

• Upgrade every controlled Metabase image, chart, compose service, pin, SBOM, and runbook to the patched release on the same train.
• Until rollout is complete, deny /api/session/reset_password at the reverse proxy, load balancer, or WAF.
• After a public or untrusted-network exposure, follow the vendor incident steps: revoke active sessions (core_session), review API keys and administrator accounts, rotate credentials for connected warehouses, and review Metabase activity plus warehouse logs for unauthorized access.
• Keep Metabase off the public internet unless it has a reviewed authentication boundary. Restrict the application database and warehouse credentials to the Metabase service identity.

The prompt

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-72898, a critical unauthenticated Metabase SQL
injection on the password-reset surface. Produce exactly one output:

- A reviewer-ready PR/change request that upgrades Metabase to the matching
  patched train, contains `/api/session/reset_password` during rollout, and
  documents incident cleanup, or
- TRIAGE.md if this repository does not own an affected Metabase runtime.

## Rules

- Scope only CVE-2026-72898 and directly related Metabase version, ingress,
  password-reset containment, and post-exposure cleanup.
- Treat Metabase application-database contents, warehouse credentials, API
  keys, session rows, and query history as sensitive.
- Do not prove exposure by sending SQL, calling `/api/session/reset_password`,
  creating admin users, or reading production session tables as an attacker.
- Do not invent a patched version. Use only the vendor/NVD/repo-advisory
  trains listed in this recipe. Live global GHAD is 404.
- Do not auto-merge.

## Steps

1. Inventory every Metabase runtime this repository controls: images, compose
   files, Helm charts, Kubernetes manifests, Terraform, version pins, gateway
   config, SBOMs, and runbooks.
2. Record edition (`0.x` OSS vs `1.x` Enterprise) and exact version. A target
   is vulnerable if it is on a listed train below the patched release.
3. If Metabase is not owned here, stop with `TRIAGE.md` listing files
   checked, owner if known, observed version, and the required patched
   release.
4. Upgrade to the matching patched release:
   OSS `0.58.24` / `0.59.21` / `0.60.17` / `0.61.11` / `0.62.9` / `0.63.5+`
   or Enterprise `1.58.24` / `1.59.21` / `1.60.17` / `1.61.11` / `1.62.9` /
   `1.63.5+`.
5. Deny `/api/session/reset_password` at the edge until every replica is
   patched. Keep that block documented if rollout is staged.
6. Add safe checks that reject the vulnerable version ranges and assert the
   gateway deny rule exists during rollout. Do not hit the reset-password
   route with payloads.
7. Add a PR body section named `CVE-2026-72898 operator actions` that states:
   - versions before and after;
   - whether `/api/session/reset_password` was publicly reachable;
   - whether session revocation, API-key review, admin review, and warehouse
     credential rotation are required or already completed;
   - any temporary edge block that must remain until deployment completes.
8. Use PR title:
   `fix(sec): remediate CVE-2026-72898 in Metabase`.

## Stop conditions

- No affected Metabase runtime is controlled by this repository.
- The owned train has no documented patched release and edge containment
  cannot be applied.
- Verification would require injecting SQL, resetting passwords, or exposing
  warehouse credentials.
- Validation fails for unrelated pre-existing reasons; document those
  failures instead of broadening scope.

Rollback

Do not restore a vulnerable Metabase train to a reachable deployment. If the patched release must be withdrawn, keep /api/session/reset_password denied or take the service off untrusted networks until another patched build is installed.

Verification - what the reviewer looks for

• Every controlled Metabase pin, image, chart, and runbook is on a patched release for its train.
• /api/session/reset_password is denied at the edge while any replica is unpatched.
• Tests do not send SQL or exercise password reset as an attacker.
• Operator notes cover KEV urgency and, after public exposure, session revocation, API-key and admin review, and warehouse credential rotation.

Output contract

• Reviewer-ready PR upgrading Metabase to a vendor-patched train and documenting containment plus incident cleanup.
• TRIAGE.md when Metabase ownership, upgrade authority, or cleanup is outside this repository.

Watch for

• Upgrading one compose service while a Helm values file, preview app, or managed instance stays on a vulnerable tag.
• Treating Enterprise 1.x and OSS 0.x pins as interchangeable.
• Assuming an in-train build between the advisory affected bound and the patched release is safe.
• Skipping session and credential rotation because the upgrade succeeded.

Related recipes

• Search the CVE Database for CVE-2026-72898
• CVE intelligence intake gate

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72898
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898
• Metabase advisory: https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
• Metabase security update: https://www.metabase.com/blog/security-update
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-72898