Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Summary: Metabase disclosed a maximum-severity SQL injection flaw, now tracked as CVE-2026-72898 with a CVSS score of 10.0, that lets an unauthenticated remote attacker inject arbitrary SQL through the '/reset_password' endpoint and gain administrator access to the instance. Metabase said its Cloud service was attacked via the zero-day in versions 1.58 and above, and the flaw has been added to CISA's KEV catalog with a federal remediation deadline of August 14, 2026.
Key Takeaway: Wiz found roughly 13% of cloud environments run self-hosted Metabase, about 25% of those fully internet-accessible and an estimated 2,500 instances exposed, and the fallout already includes Framework customer names, addresses, phone numbers and emails, 136 n8n customer records, and exposed Kilo Slack access tokens.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-38646
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026