Two lines in a log file are the tell. A POST to /api/session/reset_password that comes back 400, then a GET to /api/user/current that comes back 200. According to France's national cyber security agency, that pair is how administrators find out somebody has already walked into their Metabase server with full rights.
ANSSI's CERT-FR raised the issue to a formal alerte on 10 September, and the wording is blunt: the team says it is aware of numerous compromises of vulnerable Metabase instances. The bulletin is not a warning that something might happen. It is a notice that it has been happening, plus instructions for working out whether you are one of the victims.
The tier itself carries information. This is CERTFR-2026-ALE-010, the tenth alerte the agency has issued all year, and the routine advisory it cross-references in the same document is numbered CERTFR-2026-AVI-1075. CERT-FR publishes advisories by the thousand. It publishes alertes when something is actively going wrong.
One request, no password, full admin
Metabase is the open-source tool companies use to build dashboards on top of their production databases, which makes an administrator account on it an unusually good place for an intruder to stand. The flaw, CVE-2026-72898, lets a remote attacker with no account at all inject arbitrary SQL through the password-reset endpoint and come out with administrator rights on the instance. It carries the maximum CVSS score of 10, and its EPSS rating puts the probability of exploitation in the wild at roughly 94%, near the very top of that scale.
None of that part is new, and CERT-FR does not claim it is. Metabase published its security advisory and fixed builds on 6 August, followed by a fuller account of what happened on 27 August, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 11 August. We covered it at the time: a critical Metabase bug that hands attackers admin access outright. What the alerte adds, five weeks after the fix shipped, is the population of servers that never applied it and now belong to somebody else.
Which builds are exposed, and the stopgap
CERT-FR lists the affected releases as Metabase before x.58.28 and before x.63.10, plus the x.59 line before x.59.25, x.60 before x.60.21, x.61 before x.61.15, and x.62 before x.62.13. The agency's recommendation is to apply the vendor's patches as fast as possible. Where that cannot happen immediately, Metabase's own advice is to block public access to the /api/session/reset_password path. The fixed builds and the technical detail sit in Metabase's security update of 6 August and its GitHub advisory.
If that path was public, patching is not enough
Where the reset-password endpoint was reachable from the internet, CERT-FR passes on the vendor's recovery steps, and they read like a credential-rotation exercise rather than a software update. Revoke every active session by deleting all rows from the core_session table in the Metabase application database. Audit API keys and delete any that are not recognised. Inspect administrator accounts for changes nobody made. Renew the access credentials for every connected database. Then comb the logs, and Metabase's own activity and query history, for anything unauthorised. French organisations that confirm a compromise are asked to report it to CERT-FR and copy their sector CSIRT.
The credential rotation is the step teams will be tempted to skip, and it is the one that matters most. A Metabase instance holds live connection details for every database it queries, so an attacker who reached administrator did not walk away with a dashboard. They walked away with the keys to whatever the dashboard was pointed at, and patching the application does nothing to take those back.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.