CVE-2026-72900

Executive Summary

CVE-2026-72900 is an authorization flaw in Metabase that permits an authenticated, low-privileged user to read the entire Metabase application database. The vulnerability stems from missing authorization checks (CWE-862) on a server-side function that exposes backend data without proper privilege validation. Because Metabase stores configuration secrets, user credentials, and database connection strings internally, successful exploitation results in full confidentiality loss of the application's backend. The vulnerability carries a CVSS score of 6.5 (High), is currently unpatched, and has no known public exploit code or CISA KEV listing at the time of this report.

Technical Analysis

The NVD description for CVE-2026-72900 is intentionally sparse, providing only the high-level statement: "Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database." This establishes the vulnerability class as an authorization bypass rooted in CWE-862 (Missing Authorization).

Vulnerability Mechanism (class-level):

The flaw resides in a failure to enforce privilege checks before permitting read access to the application database. In the context of Metabase — a business intelligence and analytics platform — the application database is the internal PostgreSQL or H2 store that persists:

• User accounts and password hashes
• Database connection strings (including credentials for connected data sources)
• Dashboard and query definitions
• Embedded analytics settings and API keys
• Session tokens and application-level secrets

The attack mechanism follows the pattern of "direct object reference" or "unrestricted read" — a function or endpoint in the application can be invoked by any authenticated user, but was designed to be callable only by administrators or superusers. Because the check is missing (rather than flawed), the server processes the request and returns the database contents directly to the caller.

Attack Surface:

• Authentication requirement: The attacker must hold valid low-privileged credentials (e.g., a standard viewer or analyst role). This lowers the exploitation barrier — user enumeration or credential stuffing may yield such access.
• Network exposure: The vulnerable function is reachable over the network via the Metabase web interface (typically port 3000 or behind a reverse proxy).
• No authentication bypass: The vulnerability does not allow unauthenticated access; it leverages existing low-privilege credentials.

Technical specifics not available from the NVD description:

The NVD entry does not disclose the exact API endpoint, function name, or application code path involved. Per our accuracy rules, we do not speculate on these details. What can be asserted with confidence:

• The flaw is an authorization oversight, not an injection or deserialization bug.
• Impact is restricted to confidentiality (C:I/N) — no integrity or availability consequences.
• Attack complexity is Low (no special conditions required beyond credentials), and no user interaction is needed.

CVSS Vector Analysis: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N — Network attack vector, Low complexity, Low privileges required, No user interaction, Scope Unchanged, High confidentiality impact, no integrity or availability impact.

EPSS: 0.00300 (22.5th percentile) indicates low current exploitation probability, but this may change if PoC becomes public.

Exploitation Scenarios

No public proof-of-concept is available, and no Nuclei template or exploit code exists. The attack chain below is inferred strictly from the vulnerability class defined by the NVD description.

Step 1 — Reconnaissance and Target Identification

The attacker first identifies Metabase instances. This can be done via:

• Shodan/Fofa searches for the default Metabase web interface (HTTP title "Metabase" or the default application port 3000).
• Internal network scanning if the attacker is already inside the perimeter.
• Identifying the application version via login page fingerprinting or /api/health endpoint response.

Step 2 — Gaining Low-Privileged Credentials

Since the vulnerability requires authentication, the attacker must obtain a low-privileged account. Common vectors:

• Default credentials if the instance was deployed with weak defaults.
• Credential stuffing using leaked credentials from prior breaches.
• Social engineering against low-privilege users (analysts, viewers).
• Harvesting credentials from previous phishing campaigns.

Step 3 — Triggering the Authorization Bypass

Once authenticated, the attacker crafts a request that invokes the vulnerable function intended for administrative use. At the class level, this involves:

• Calling an application API endpoint that retrieves database contents (e.g., a database dump, settings export, or user list endpoint).
• Bypassing the client-side privilege check by directly sending an API request (clients often hide UI elements but the server must enforce authorization).

Note: We do not know the exact endpoint name or parameter structure — this is unavailable in the NVD description. The attack is described at the class level (missing authorization check on a database-read function).

Step 4 — Data Exfiltration and Post-Exploitation

Successful exploitation returns the full application database contents. The attacker can:

• Extract password hashes for offline cracking.
• Retrieve database connection strings (including usernames/passwords for connected business databases).
• Obtain session tokens allowing impersonation of other users.
• Extract embedded secrets (SMTP credentials, encryption keys).
• Use harvested data for further lateral movement or ransomware deployment.

Post-Exploitation Impact Chain:

Once the attacker possesses database credentials from the Metabase configuration, they may pivot from the BI platform to the underlying business databases (e.g., PostgreSQL, MySQL, SQL Server) directly, potentially escalating a single low-privilege account compromise into broad data breach.

Impact Assessment

Business Impact:

• Confidentiality Breach (High): The vulnerability exposes the entire Metabase application database. For an enterprise BI tool, this includes metadata about all dashboards, user roles, permissions, and connected data sources — essentially the map of the organization's analytical infrastructure.
• Credential Exposure: The database stores connection strings to business data warehouses and transactional databases. An attacker retrieving these can access sensitive production data without further exploitation.
• Regulatory Risk: If the Metabase application database contains PII, PHI, or cardholder data (via user records or embedded analytics data), the breach may trigger notification requirements under GDPR, HIPAA, PCI-DSS, or other regulations.
• Supply Chain Risk: Compromised credentials may include API keys for third-party services integrated with Metabase (e.g., Slack, email services, cloud storage).

Affected Systems:

• All deployments of Metabase where the vulnerable code path is present (version range unknown — no affected versions listed).
• Organizations running Metabase in production with low-privileged user accounts configured.
• Deployments exposed to the internet or accessible from untrusted network segments.

Blast Radius:

• Scope Unchanged (CVSS S:U): The vulnerability does not cross trust boundaries. The attacker remains within the Metabase application's security context.
• Confidentiality Impact: High (C:H): Complete disclosure of the application database is achievable.
• Integrity Impact: None (I:N): The attacker cannot modify data.
• Availability Impact: None (A:N): No denial-of-service potential.

EPSS Context: The EPSS score of 0.00300 (22.5th percentile) indicates moderate relative exploitability likelihood compared to other CVEs, suggesting it may become a target once details become public.

Detection Guidance

Detection rules below are designed to identify the client-side behavior and network signatures of a potential exploitation attempt. Since the exact endpoint is unknown, rules target the class of activity: an authenticated low-privileged user requesting bulk database export or metadata dump operations.

Sigma Rule

title: Metabase Application Database Export by Low-Privileged User
id: cve-2026-72900-db-exfil
status: experimental
description: Detects requests to Metabase API endpoints that export or dump application database contents by non-admin users.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72900
author: Valters IT Security Research
date: 2026/05/15
logsource:
    category: web
    product: metabase
detection:
    selection_user:
        user_role: [viewer, analyst]
    selection_req:
        cs-method: GET
        cs-uri-query|contains:
            - "api/database"
            - "api/user"
            - "api/setting"
            - "api/collection"
            - "export"
            - "dump"
    selection_resp:
        sc-status: 200
        sc-bytes|gte: 100000
    condition: selection_user and selection_req and selection_resp
falsepositives:
    - Legitimate admin export operations
    - API responses larger than 100KB
level: high
tags:
    - attack.t1078
    - attack.t1005
    - cve.2026-72900

YARA Rule

rule cve_2026_72900_metabase_db_dump
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP responses indicating Metabase application database content exfiltration"
        cve = "CVE-2026-72900"
        date = "2026-05-15"
        severity = "high"
    strings:
        $db_marker = "database_id"
        $user_marker = "password_salt"
        $settings_marker = "site_url"
        $export_marker = "export-format" nocase
        $json_arr = "{\"data\":" ascii
        $metabase_tag = "metabase" ascii nocase
        $bulk = "total" ascii
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x7B7B and  // starts with [ or {
        2 of ($db_marker, $user_marker, $settings_marker) and
        $json_arr and $metabase_tag and $bulk
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Metabase CVE-2026-72900 Application Database Read Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/"; http_uri; nocase;
    content:"export"; http_uri; nocase;
    content:"Cookie"; http_header; nocase;
    pcre:"/api\/(database|user|setting|collection|setup)/";
    classtype:attempted-user;
    reference:cve,2026-72900;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72900;
    sid:2290001;
    rev:1;
    metadata:attack_target_web_application;
    metadata:affected_product_metabase;
    metadata:created_at_2026_05_15;
)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and http.request.method == "GET"
    and http.request.uri includes "/api/database" or http.request.uri includes "/api/setting" ]
  [ network where network.protocol == "http" and http.response.status_code == 200
    and network.bytes > 50000 ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=apache
| where like(uri, "%/api/%")
| search (uri="*/api/database*" OR uri="*/api/setting*" OR uri="*/api/user*")
| search method="GET" status=200 bytes>50000
| rex field=user "user=(?<username>[^|]+)"
| lookup metabase_user_roles username OUTPUT role
| where role != "administrator"
| stats count min(_time) max(_time) by src_ip, uri, username
| where count >= 1
| table _time, src_ip, username, uri, count

Wazuh OSSEC Rule

<rule id="229001" level="12">
    <if_sid>31100</if_sid> <!-- Generic web server 200 rule -->
    <field name="url">\ /api/(database|setting|user|collection|export)</field>
    <description>Metabase CVE-2026-72900 - low-privileged user attempting database export</description>
    <group>web_application, exploit, metabase, cve_2026_72900</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No vendor patch, commit reference, or version fix is available from any tracked source. Metabase has not published an advisory or CVE note at the time of writing. Organizations must treat this CVE as actively exploitable and apply compensatory controls.

1) Immediate Mitigations (no patch available)

• Restrict low-privileged account creation: Audit current user accounts and disable any non-admin accounts unless explicitly required by business function.
• Network segmentation: Place Metabase instances behind a VPN or zero-trust proxy. Restrict access to trusted IP ranges where possible.
• Web Application Firewall (WAF) rules: Deploy custom WAF rules to block requests matching the detection patterns above (e.g., /api/database, /api/setting endpoints from non-admin source IPs).
• Disable public exposure: If the Metabase instance does not require internet access, remove public DNS records and firewall rules.
• Monitor database audit logs: Enable logging on the underlying Metabase application database and monitor for unexpected read operations or connection attempts.
• Credential rotation: Rotate all credentials stored in the Metabase application database (database connection strings, API keys, SMTP passwords) as a precautionary measure.
• Minimize stored secrets: Remove unnecessary database connection details from Metabase configuration; use tokenized or ephemeral credentials where feasible.

2) Patch/Upgrade Steps

• Monitor the Metabase security advisory page (https://www.metabase.com/security/) and NVD for an updated CVE entry with a fixed version.
• When a patched version is released, upgrade all Metabase instances immediately. Apply the vendor's migration scripts as documented.
• If the version is listed in the vendor advisory as affected, upgrade to the first patched release.
• Ensure upgrade testing is performed in a staging environment before production deployment.

3) Long-Term Hardening

• Role-based access control (RBAC) review: Regularly audit user roles and permissions. Apply the principle of least privilege.
• Application hardening: Run Metabase behind a reverse proxy with request validation. Enforce strong authentication (MFA) for all users, including low-privilege accounts.
• Database encryption: Enable the Metabase application database encryption at rest; use the built-in encryption for sensitive fields where available.
• Configuration backups: Maintain encrypted backups of the Metabase configuration and database, ensuring recovery capability in case of data destruction.
• Vulnerability management program: Integrate CVE feeds and vendor advisories into an automated patching workflow.
• Logging and SIEM integration: Forward Metabase application logs to a centralized SIEM and create alerts on anomalous API access patterns identified in the Detection Guidance section.

References

1. NVD Entry (Primary): https://nvd.nist.gov/vuln/detail/CVE-2026-72900
2. MITRE CWE-862: https://cwe.mitre.org/data/definitions/862.html — Missing Authorization
3. Metabase Security Advisories (Vendor): https://www.metabase.com/security/
4. EPSS Data Reference: https://www.first.org/epss/ — CVE-2026-72900 EPSS score 0.00300
5. CISA KEV (Not Listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-72900 is not present in the KEV catalog

Exploit-in-the-Wild Evidence: None confirmed. CISA KEV does not list this CVE. No threat actor campaigns have been reported referencing this vulnerability. EPSS percentile (22.5%) suggests moderate relative exploitation likelihood but low absolute probability until more technical details become public.

Disclaimer: Technical specifics (endpoint names, function identifiers) are not available from the NVD description. Attack chain descriptions are generalized to the vulnerability class (CWE-862 Missing Authorization) and should be refined once vendor disclosure or additional research becomes available.