Self-hosted Metabase: attackers are still using a no-login SQL injection to become admin. Upgrade your branch today

Singapore’s Cyber Security Agency warned on November 4 that attackers are still using a critical Metabase flaw to take over dashboards without a login. The bug injects SQL into Metabase’s own application database and can hand the attacker an administrator session.

Metabase Cloud was patched when the vendor first shipped the fix. Self-hosted instances on the 58 through 63 branches still need the point release for their series, and anything that was reachable on the public internet should be treated as possibly compromised.

One unauthenticated password-reset request can make you a Metabase admin. Upgrade the branch you run, then revoke sessions and rotate connected database credentials.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Singapore flags active Metabase attacks

CVE-2026-72898 is a critical SQL injection in the POST /api/session/reset_password endpoint, rated CVSS 3.1 10.0. Metabase confirmed active exploitation when it published the advisory, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 11.

The endpoint is supposed to accept only a reset token and a new password. Extra fields in the request body reached Metabase’s query builder and let an attacker splice SQL into the application database lookup before any authentication check. From there the attacker can create or take over an admin account, change configuration, steal stored credentials for connected warehouses, and export data.

• Open-source and Enterprise (1.x) branches 58–63 are affected. Minimum safe builds: 0.58.24 / 1.58.24, 0.59.21 / 1.59.21, 0.60.17 / 1.60.17, 0.61.11 / 1.61.11, 0.62.9 / 1.62.9, 0.63.5 / 1.63.5.
• Versions below 58 are not vulnerable. Metabase Cloud customers were upgraded by the vendor.
• Singapore’s CSA alert on November 4, and a public proof-of-concept write-up, keep the pressure on any instance that never took the August point release.

Self-hosted dashboards tied to live databases

Metabase sits in front of production databases for reporting. An attacker who becomes admin inherits every stored connection string and can read whatever those connections can read. Self-hosted instances exposed to the internet are the first target; internal instances reachable from a compromised laptop are next.

The attack pattern in the vendor advisory is a POST /api/session/reset_password that returns HTTP 400, followed by a GET /api/user/current that returns 200. That sequence in your ingress or application logs is enough to start incident response.

Upgrade your branch, then revoke sessions and rotate

• Confirm the running version (About Metabase) and upgrade to the minimum safe build for that branch, or newer.
• If you cannot upgrade yet, block /api/session/reset_password at the reverse proxy as a temporary workaround.
• After upgrading a publicly reachable instance: delete every row in core_session, review admin accounts and API keys, rotate credentials for every connected database, and review Metabase query history plus warehouse logs for unexpected access.
• Search ingress and application logs for the 400-then-200 pattern above, and for any new admin users you did not create.
• Triaging a possible Metabase compromise sits next to other detection work this week. Our CySA+ exam guide covers the analyst workflow for that kind of hunt.

Details

• CVE-2026-72898 / GHSA-vwf4-m7j8-wcjf: unauthenticated SQL injection via password-reset body fields → admin access. CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
• Fixed: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5 and matching Enterprise 1.x builds. Below 58: not affected.
• Workaround: block POST /api/session/reset_password until the upgrade lands.
• Exploitation: confirmed by Metabase; on CISA KEV since August 11 (federal due date was August 14); CSA Singapore re-alerted November 4; public PoC available.

Hunt / verify

• List Metabase containers and hosts: docker ps --format '{{.Image}} {{.Names}}' | grep -i metabase, and any systemd units or Helm releases named metabase.
• Compare the About Metabase version against the safe builds above.
• In reverse-proxy or WAF logs, find /api/session/reset_password POSTs that returned 400, then a same-client /api/user/current that returned 200.
• In the application database, inspect core_user for unexpected is_superuser rows and core_session for sessions you cannot explain.

Source: Metabase security update; CSA Singapore alert

Sources

• Metabase: Security update available — please upgrade now
• GitHub: GHSA-vwf4-m7j8-wcjf SQL injection leading to admin access
• Cyber Security Agency of Singapore: Active Exploitation of Metabase Vulnerability (November 4, 2026)
• Beazley Security Labs: Metabase SQLi actively exploited (CVE-2026-72898)
• Rift Weld Labs: CVE-2026-72898 technical write-up
• CVE.org: CVE-2026-72898
• NVD: CVE-2026-72898

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].