THREAT INTELLIGENCE REPORT — CVE-2026-72898

Prepared by: Valtersit Threat Intelligence
Date: 2026
Classification: CRITICAL — Remote Unauthenticated SQL Injection → Account Takeover

Executive Summary

CVE-2026-72898 is a critical unauthenticated SQL injection vulnerability in the Metabase /reset_password database endpoint. A remote attacker with no credentials can inject arbitrary SQL, potentially bypassing authentication controls to gain full administrator access to the connected Metabase instance, leading to complete compromise of analytical data and the underlying infrastructure. The vulnerability is unpatched, carries a CVSS score of 10.0, and affects all Metabase deployments exposed to untrusted networks; no CISA KEV listing or public exploit code has been observed at the time of writing, though the attack surface (a public-facing web UI) makes in-the-wild exploitation likely in the near term.

Technical Analysis

The vulnerability resides in the Metabase /reset_password endpoint — a URL path explicitly named in the NVD description. The description states that a remote, unauthenticated attacker can inject arbitrary SQL via this endpoint, and that the objective/outcome of successful injection is the acquisition of administrator access to the connected Metabase instance.

The vulnerability class is CWE-89 — SQL Injection. The described mechanism implies that the /reset_password endpoint fails to properly validate or parameterize user-supplied input before embedding it in a SQL query. Because the endpoint is part of the password-reset flow (a self-service, pre-authentication function), it is reachable by any external user who can reach the Metabase HTTP interface (typically TCP/3000). This makes the endpoint an entry point into the application before any authentication has occurred.

The injection allows the attacker to execute arbitrary SQL statements outside the intended query context. In the context of a password-reset flow, the underlying query likely involves looking up a user record (e.g., email address or reset token) to send a reset link. A classic SQL injection in this context would permit an attacker to manipulate the query to return arbitrary rows, bypass the "user exists" check, or — more dangerously — directly modify the database to re-issue an administrator password or insert a new privileged account.

Chain of consequences: Successful SQL injection yields administrator authentication bypass. Once authenticated as an administrator, the attacker has full control of the Metabase instance, which typically includes:

• Access to all connected databases and data sources.
• Ability to create/modify/delete queries and dashboards.
• Ability to read all secrets/credentials stored in the Metabase application database.
• Ability to enable/disable features and potentially execute further code via Metabase's driver interfaces.

The NVD description specifically states the goal of the injection is "gain administrator access to the connected Metabase instance," confirming that the attack passes the authentication boundary.

What we do NOT know (insufficient technical detail is available):

• The exact vulnerable parameter name (e.g., email, token, user_id) — the NVD description only names the endpoint path /reset_password.
• The database backend in use (H2, PostgreSQL, MySQL) — though the injection is described as applying generically.
• The specific SQL query structure or whether the flaw is in input validation, string concatenation, or an unsafe ORM call.
• Affected Metabase version numbers.

These details are not provided by the CVE data and are not independently verifiable at the time of writing. The attack mechanism is therefore described at the vulnerability-class level.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (SQL injection in a pre-auth endpoint) and the explicit NVD description stating that the goal is administrator access. No public PoC is available; this chain is the most plausible path based on the described CVE data.

Step 1 — Reconnaissance / Target Identification.
An attacker scans the internet for exposed Metabase instances. Metabase's default port is 3000, but deployments are commonly reverse-proxied on 80/443. Shodan/Censys queries for http.title:"Metabase" or html:"Metabase" will readily identify instances. The /reset_password endpoint is reachable pre-authentication by simply navigating to the base URL followed by the path. No authentication session is needed to begin the attack.

Step 2 — Triggering the Flaw (SQL Injection).
The attacker sends an HTTP request to the /reset_password endpoint, either GET or POST, containing crafted malicious SQL in the vulnerable input parameter. Because the exact parameter name is unknown from the CVE data, the attacker would attempt injection in likely fields such as an email address or a token parameter. A typical payload at the vulnerability-class level would be:

' OR '1'='1

or a more targeted payload such as:

' UNION SELECT ... --

designed to manipulate the backend query and cause it to return records or perform actions the application did not intend — e.g., returning an administrator record as the valid "user" for whom a reset token is generated. The endpoint's failure to parameterize the query allows this crafted input to be interpreted as SQL logic rather than opaque data.

Step 3 — Payload Execution / Exploitation.
By manipulating the query via the injection, the attacker can:

1. Bypass any intended restriction (e.g., force the query to match an administrator's email/account).
2. Trigger the generation of a valid password-reset token for the administrator account.
3. Intercept/obtain that token (either directly in the HTTP response or by causing the application to display it in an error/log).
4. Use the token to reset the administrator's password to a value chosen by the attacker.

Alternatively, if the database user is sufficiently privileged (which is common in embedded/self-hosted Metabase deployments using the bundled H2 database), the attacker may use stacked queries to directly issue UPDATE statements such as:

'; UPDATE users SET password='...' WHERE role='admin'; --

— however, specific SQL syntax is implementation-dependent, and the NVD description does not confirm stacked-query support.

Step 4 — Post-Exploitation.
With a modified or known administrator password, the attacker logs in to the Metabase instance as an administrator. Post-exploitation impact includes:

• Full read/write access to every data source connected to Metabase (databases, warehouses, data lakes), including potentially sensitive financial, PII, or operational data.
• Ability to extract or exfiltrate data at scale via arbitrary queries.
• Theft of all saved credentials/secrets stored in Metabase's application database (e.g., database passwords for connected sources).
• Potential pivoting to the Metabase host machine if the database driver or server configuration permits file read/write or code execution — this is not confirmed by the CVE but is a plausible outcome for a fully administrator-controlled instance.

Impact Assessment

CVSS Breakdown (from provided vector):

• AV:N — Attack Vector: Network. Exploitable remotely over the network with no physical access.
• AC:L — Attack Complexity: Low. No special conditions or race conditions required.
• PR:N — Privileges Required: None. Unauthenticated exploitation.
• UI:N — User Interaction: None. No victim interaction required.
• S:C — Scope: Changed. The compromise extends beyond the vulnerable component's security scope — the injected SQL achieves administrator access, escalating privileges within the broader Metabase application/database ecosystem.
• C:H / I:H / A:H — Complete loss of confidentiality, integrity, and availability.

The CVSS base score of 10.0 places this vulnerability in the most severe category possible.

Business Impact:

• Data Breach: Direct exposure of all analytics data, dashboards, and underlying connected data sources. For enterprises using Metabase as a BI layer over production data, this constitutes full data compromise.
• Regulatory/Compliance: Depending on data types (PII, PHI, PCI), a breach could trigger GDPR, HIPAA, or PCI-DSS notification requirements and fines.
• Supply Chain Risk: Metabase is frequently deployed as a shared service across multiple internal teams; a single admin compromise affects all tenants.
• Availability Impact: An attacker with admin access can delete dashboards, modify queries, or disable the service, causing outage.
• Lateral Movement: With extracted database credentials, the attacker may pivot directly to the underlying databases or data warehouse infrastructure.

Affected Systems: All Metabase deployments — and the specific flaw is in a pre-auth endpoint, so any instance reachable over the network is at risk, including instances protected by VPNs or network ACLs if the /reset_password endpoint is reachable from any untrusted network segment.

Blast Radius: Complete takeover of the Metabase application, with potential escalation to all connected data sources and the host OS.

Detection Guidance

Detection of this vulnerability is challenging because the URL /reset_password is a legitimate endpoint used by all users. Detection must therefore focus on anomalous request patterns and unusual payload characteristics.

Sigma Rule

title: Metabase /reset_password SQL Injection Attempt
id: 3f7c92c1-8d2e-4b7a-9f3d-28a4d5e6f7a8
status: experimental
description: Detects SQL injection payloads in requests to the Metabase /reset_password endpoint, indicating possible exploitation of CVE-2026-72898
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: apache
  definition: Detection of HTTP requests to Metabase web application
detection:
  selection:
    cs-uri-path|contains:
      - '/reset_password'
  keywords:
    cs-uri-query|contains:
      - "'"
      - "OR '1'='1"
      - "UNION SELECT"
      - "UNION+SELECT"
      - "sleep("
      - "BENCHMARK("
      - "--"
      - "/*"
      - ";"
  condition: selection and keywords
  timeframe: 5m
falsepositives:
  - Legitimate password reset requests with special characters (e.g., email addresses containing apostrophes - rare)
  - The single-quote (') alone may cause false positives; tune by requiring multiple keywords
level: high
fields:
  - src_ip
  - cs-uri-query
  - user-agent
tags:
  - attack.t1190
  - cve.2026-72898
  - cwe.89

YARA Rule

rule Metabase_ResetPassword_SQLi_Attempt {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP payloads targeting the /reset_password endpoint with SQL injection patterns (CVE-2026-72898)"
        cve = "CVE-2026-72898"
        cwe = "CWE-89"
        date = "2026-01-01"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72898"
        tags = "sql-injection, metabase, auth-bypass"

    strings:
        $endpoint_lower = "/reset_password"
        $sqli1 = "OR '1'='1"
        $sqli2 = "or '1'='1"
        $sqli3 = "UNION SELECT"
        $sqli4 = "union select"
        $sqli5 = "AND '1'='1"
        $sqli6 = "and '1'='1"
        $sqli7 = "sleep("
        $sqli8 = "BENCHMARK("
        $sqli9 = "-- -"
        $sqli10 = "--"
        $sqli11 = "/*"
        $sqli12 = "';"
        $sqli14 = "WAITFOR DELAY"

    condition:
        any of ($endpoint_*) and
        (any of ($sqli*) or #sqli* >= 3)
}

Note: The YARA rule is designed to inspect HTTP request payloads in logs, packet captures, or WAF alert logs. It does not match on live traffic by itself.

Suricata IDS Rule

alert http any any -> any any (msg:"METABASE CVE-2026-72898 SQL Injection Attempt in /reset_password endpoint"; flow:established,to_server; http.uri; content:"/reset_password"; http.uri; content:"'"; http.uri; pcre:"/(?i)(union[\s]+select|\bOR\b['\"]?\s*['\"]?\s*=|--\s*-?\s*$|/\*|sleep\s*\(|benchmark\s*\()/"; classtype:attempted-admin; sid:202672898; rev:1; reference:cve,2026-72898; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72898; priority:1; metadata:created_at 2026-01-01, updated_at 2026-01-01, mitre_attack_id T1190;)

Explanation: The rule inspects HTTP requests to the /reset_password URI. It requires both a single-quote character and a SQL-specific keyword/pattern (UNION SELECT, OR with quote, -- comment, /* comment, sleep(, BENCHMARK() to fire, reducing false positives.

Elastic Detection (EQL)

sequence by source.ip with maxspan=5m
  [ network where
      destination.port in (80, 443, 3000) and
      url.path == "/reset_password" and
      url.query == "*'*" and
      (url.query like "*UNION*" or url.query like "*union*" or
       url.query like "*SELECT*" or url.query like "*select*" or
       url.query like "*sleep*" or url.query like "*--*" or
       url.query like "*/*" or url.query like "*benchmark*")
  ]

Note: In Elastic EQL, the url.path and url.query fields are populated by packetbeat or the Elastic web proxy ingestion. The rule looks for an HTTP request to /reset_password containing both a single-quote and a SQL keyword, the combination strongly indicative of SQL injection probing.

Splunk SPL Query

index=web OR sourcetype=access_combined
| where like(uri_path, "%/reset_password%")
| eval s = lower(uri_query + uri_path)
| where s like "%'%" 
  AND (s like "%union%select%" OR s like "%or '1'='1%" OR s like "%--%" OR s like "%/*%" OR s like "%sleep(%" OR s like "%benchmark(%")
| stats count by src_ip, uri_query, user_agent, _time
| sort - count
| table _time, src_ip, uri_query, user_agent, count
| rename src_ip as "Source IP", uri_query as "Request URI", user_agent as "User-Agent", count as "Request Count"

Explanation: This SPL searches standard web access logs (Apache access_combined or a generic web source index) for requests to /reset_password that contain both a single quote and SQL injection keywords. The lower() function normalizes case. like "%'"% detects the presence of a single quote. The subsequent like checks detect specific SQLi signatures. Normalize as needed if the request fields have different names.

Wazuh OSSEC Rule

<group name="metabase,">
  <rule id="100728" level="12">
    <decoded_as>web</decoded_as>
    <match>/reset_password</match>
    <regex>(\'|%27).*(UNION|union|SELECT|select|sleep\(|benchmark\(|--|/\*|\bOR\b)</regex>
    <description>Metabase CVE-2026-72898: SQL injection attempt detected in /reset_password endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
    <info type="cve">CVE-2026-72898</info>
    <info type="cwe">CWE-89</info>
    <options>no_full_log</options>
  </rule>
</group>

Note: This rule assumes Wazuh is ingesting Apache/Nginx logs via the web decoder or a similar generic decoder. The regex combines the /reset_password path with a single-quote and a SQL keyword. Level 12 is considered a critical alert. Adjust the decoder field names based on your Wazuh ingestion pipeline.

Mitigation & Patch Guidance

⚠ CRITICAL: Patch Confidence 0/4 — NO patch is available from any tracked source. The vendor has not acknowledged the flaw, and no fix has been published. All mitigations below are interim and do not resolve the underlying vulnerability.

1. Immediate Mitigations (implement within hours):

• Restrict network access: Place Metabase behind a firewall/proxy that allows access only from trusted IP ranges or VPN. Ensure /reset_password is not reachable from the internet. If the instance was previously internet-facing, this is the single most effective immediate control.
• Web Application Firewall (WAF) rules: Deploy a WAF (ModSecurity, AWS WAF, Cloudflare, etc.) in front of Metabase with rules to block SQL injection payloads in requests to /reset_password. Use rules that block requests containing single-quotes plus SQL keywords. Block/rate-limit repeated failed password-reset attempts.
• Disable password-reset entirely (if acceptable): If password-reset functionality is not critical for your operational flow, block the /reset_password endpoint at the proxy level (returns 403). This fully prevents the attack vector.
• Monitor aggressively: Immediately search existing web logs for requests to /reset_password containing single quotes or SQL keywords. Assume any such request since the system was deployed is a potential compromise, and treat as a security incident.
• Rotate all credentials: Because a successful exploit yields administrator access, proactively rotate all Metabase application admin passwords and any credentials stored within Metabase for connected data sources. The window of exposure is unknown; assume compromise if the instance has been internet-exposed.

2. Patch / Upgrade Steps (when available):

• Constantly monitor the official Metabase security announcements and release notes. Subscribe to the Metabase security mailing list or GitHub advisories.
• When a patched version is released, upgrade immediately — before applying any other maintenance.
• Verify the integrity of the upgrade package via checksums/signatures.
• After upgrading, validate that the /reset_password flow no longer accepts SQL injection payloads (send a benign test payload containing ' OR '1'='1 and confirm the endpoint rejects it safely).

3. Long-Term Hardening:

• Defense in depth: Always place Metabase behind a reverse proxy with TLS, IP allow-listing, and a WAF.
• Least privilege for the application DB: Ensure the database user that Metabase connects to has only the minimal privileges necessary (no UPDATE/DELETE on user tables if possible). This limits the blast radius of SQL injection.
• Credentials management: Do not store production database credentials in Metabase if avoidable; use short-lived tokens or a vault-backed integration.
• Continuous monitoring: Deploy SIEM/SOC rules (as provided above) to detect SQL injection probing of /reset_password in real-time.
• Patch discipline: Track Metabase versions and subscribe to vendor security advisories. Treat Metabase as a critical application for security patching purposes.
• Network segmentation: Isolate the Metabase host so that even if it is compromised, lateral movement to the wider environment is restricted.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72898 — Primary reference; CVSS vector and description.
2. Metabase Security Advisories (vendor): https://www.metabase.com/docs/latest/operations-guide/start — Metabase's official security/advisory page. As of the writing of this report, no advisory for CVE-2026-72898 has been posted. Monitoring this page is critical.
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-72898 is NOT listed at the time of writing. Re-check periodically for updates.
4. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique page.

Threat Actor Activity & In-the-Wild Exploitation:
As of the writing of this report, no public exploit code, no Nuclei template, and no confirmed in-the-wild exploitation has been reported by antivirus vendors, sandboxing services, or security community sources. However, the vulnerability is of ultra-high severity (CVSS 10.0) in a widely-deployed open-source product (Metabase), reachable pre-authentication, and trivially exploitable once the vulnerable parameter is identified. Given historical patterns for similar Metabase SQLi vulnerabilities, it is highly likely that automated scanning and exploitation attempts will appear within days-to-weeks of this advisory. Enterprise teams should assume the vulnerability will be weaponized soon, regardless of the current lack of public proof-of-concept.