Published on gastropod.io on 08-14-2026

One Endpoint, Full Admin: Inside the Metabase Bug

CISA Says to Patch ASAP!!

Tags: vulnerability-intelligence, software-supply-chain-security, sql-injection, business-intelligence, self-hosted-software, zero-day

CISA added CVE-2026-72898 to its Known Exploited Vulnerabilities catalog on August 11 and gave federal agencies until today, August 14, to patch it. The bug carries a CVSS score of 10.0, the maximum. Metabase discovered the flaw only after an attacker had already used it against Metabase Cloud itself, before a fix existed.

The vulnerability is in an unauthenticated endpoint, POST /api/session/reset_password. Metabase's password-reset handler doesn't restrict which fields a request body is allowed to contain. An attacker can add extra fields the handler does not reject, and those fields will cause a lookup in application's database as raw, unvalidated input instead of a checked identifier. Metabase's query builder then treats that input as SQL rather than data. No login, no session token, no prior access required. A single crafted request gives an attacker administrative control of the entire Metabase instance (Bishop Fox).

From admin, an attacker can read every connected dashboard, change instance settings, pull stored database credentials, and run queries against any data source Metabase talks to, using Metabase's own connection privileges. The observed attack pattern is short: a POST to /api/session/reset_password, then a GET to /api/user/current to confirm the takeover worked. The Hacker News reported at least three named victims so far: Framework had customer data accessed, N8n had 136 customer records exposed, and Kilo Code had Slack tokens compromised. Affected versions span the 1.58 through 1.63 branches; patched releases are 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5.

My concern is that Metabase is the kind of tool that ends up being infrastructure that is connected to a company's important data: production replicas, warehouses, other SaaS platforms through its own connectors. That makes an admin-level compromise of this type very impactful. It's the same as recent Trivy and TeamCity incidents covered here before: a piece of internal infrastructure gets broadly used which is exactly what makes it valuable once someone finds a way in. Security Affairs has CISA's full remediation guidance, including blocking the reset-password endpoint at the network layer as an interim measure for anyone who can't patch immediately.

Most self-hosted Metabase deployments arrive as a Docker image pulled from Docker Hub or GHCR, or as a JAR file run directly on a server, often outside the inventory that a security team actively reviews. When an advisory like this one is published, the first real question should be "Which if any of your systems are actually running the vulnerable range?" That's why we built gastropod.io, so we can correlate OSV advisories like this one directly against packages, container versions, and your SBOM's so a flag on Metabase 1.58-1.63 surfaces every matching image tag and JAR across your environment all at once, rather than a message to every team asking them to check.

The gastropod.io product page covers how the SBOM and vulnerability correlation pieces fit together for exactly this kind of case.

Sources: