CVE-2026-72899 AKAOMA CVE VULNERABILITIES / 10h Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

Back cve.akaoma.com

CVE-2026-72899 AKAOMA CVE VULNERABILITIES / 10h Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

cve.akaoma.com • August 11, 2026

Share: View original

10.0 /10 Critical Risk As a catastrophic security flaw, CVE-2026-72899 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-72899 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in Metabase (CVE-2026-72899) CVE-2026-72899 is a critical unauthenticated SQL injection vulnerability affecting Metabase versions 0.58.0 to 0.63.4. The flaw allows attackers to execute arbitrary SQL queries against the Metabase application database by exploiting a publicly shared dashboard or saved question. An attacker only needs the public link UUID to exploit this vulnerability. The CVSS score for this vulnerability is 10.0, indicating its critical nature. The vulnerability arises from insufficient validation of parameter values in the public sharing endpoint. The flaw can lead to the leakage of sensitive data, including email addresses and password hashes. A patch has been developed to mitigate this issue by normalizing parameter values before SQL compilation. Immediate action is advised for affected users to prevent potential exploitation. 3 sources 77

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Cwe-89 - SQL Injection