A critical flaw in Metabase, the popular open-source tool companies use to build dashboards and query their databases, hands attackers the keys to the whole system. Tracked as CVE-2026-72898 and rated the maximum CVSS score of 10, the bug lets a remote attacker who has no account and no password reach in through the application and take over as administrator. The US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on 11 August 2026, confirming the flaw is being used in real attacks.
One unauthenticated request to admin
According to the National Vulnerability Database entry, the weakness lives in Metabase's "/reset_password" endpoint, which fails to properly separate user input from the commands it sends to the database. That lets an attacker slip in their own SQL, a technique known as SQL injection, and because the endpoint can be reached without logging in, there is nothing standing between the internet and administrator control of the connected Metabase instance. From there an intruder can read whatever the tool can read, which for a business intelligence platform is often the crown jewels of a company's data.
Why this one is dangerous
Metabase installations are frequently exposed to the internet so staff can reach their dashboards, and they sit directly on top of production databases, which is exactly the combination attackers look for. The flaw carries an EPSS score around the 79th percentile, meaning it is judged far more likely than the average vulnerability to be exploited, and the KEV listing shows that prediction has already come true. CISA has not tied it to any ransomware campaign, but a pre-authentication path to full control needs no such label to be urgent.
Update now and get it off the internet
The NVD advisory is the primary reference; Metabase's own security advisory carries the fixed release numbers and the full technical detail, and any organization running the software should apply that update immediately. Where patching cannot happen at once, take the instance off the public internet and put it behind a VPN or an allowlist, then rotate the credentials of any database it connects to on the assumption they may already be exposed. This is the latest in a run of maximum severity flaws CISA has ordered agencies to fix on a short clock, following its recent alert on a critical Oracle HTTP Server bug.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.