SQL injection in Metabase (CVE-2026-72898) — unauthenticated attackers can reach administrator access, with three days to remediate
The BI tool Metabase contains a SQL injection vulnerability that lets an unauthenticated remote attacker inject arbitrary SQL into the application database. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on August 11, 2026 with a remediation due date of August 14.
Key facts
- CVE IDCVE-2026-72898
- Affected (vendor / product)Metabase Metabase
- CWECWE-89
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-08-14 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Affected product: Metabase. Named "Metabase SQL Injection Vulnerability," CWE-89.
- CISA states an unauthenticated remote attacker can inject arbitrary SQL and obtain administrator access to the instance.
- Configuration changes and theft of stored credentials can follow, so impact does not stop at Metabase itself.
- Added to KEV 2026-08-11 with a due date of 2026-08-14 — three days.
- Required action: vendor mitigations plus compliance with BOD 26-04 and the Forensics Triage Requirements.
- A BI tool gathers connection details for the organisation databases, so the damage leaves Metabase.
1What SQL injection is
SQL injection is the flaw of an application folding user input directly into the commands it sends to a database, letting an attacker run statements that were never intended. Reading data, altering it, deleting it — in principle anything the database can do becomes possible.
It is a long-known class of vulnerability, and the reason it keeps appearing in KEV is that input handling is scattered across every part of an application.
2The stated outcome: administrator access
What makes the CISA entry heavy is that the injection is described as leading to administrator access on the instance, moving from unauthenticated to administrator in one step, with configuration changes and theft of stored credentials following from there. BI tools often hold, in one place, the credentials used to connect to many internal databases, so losing that does not stop at Metabase.
3A three-day deadline, unusually short
The dates are the point. KEV addition on 2026-08-11 and a due date of 2026-08-14 leave three days. The required action is to apply mitigations per vendor instructions and comply with CISA BOD 26-04 (Prioritizing Security Updates Based on Risk) and the Forensics Triage Requirements. Deadlines of two to three weeks have been the norm in KEV, so entries compressed to a few days signal that the operating assumptions are shifting.
4What a BI tool holds
The outcome does not end inside Metabase. What a BI tool holds is what settles the range of the damage.
- 1Begin unauthenticatedSQL injection succeeds
- 2Obtain instance administrator privilegeReach a position from which settings can be changed
- 3Take the stored credentialsA BI tool gathers connection details for the organisation's databases
- 4Damage leaves MetabaseIt reaches the databases it connects to
Added on 11 August 2026 with a remediation date of 14 August, the gap is just three days. Deadlines of two to three weeks used to be the norm on KEV, and entries shortened to a few days appearing shows the premise on the operating side changing. Because the product holds credentials, reissuing the credentials for connected databases is worth considering alongside the update.
Why it matters
An analytics platform tends to be the junction where credentials for business systems collect. Estimating the blast radius of a compromise requires knowing, in advance, what connections the product holds. Deadlines compressed to days also raise the value of deciding beforehand who applies emergency patches, who approves them, and how downtime is arranged.
FAQ
What is SQL injection?
Why is compromising a BI tool serious?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).