Critical SQL Injection Vulnerability in Metabase (CVE-2026-72899)

Feedly

Critical SQL Injection Vulnerability in Metabase (CVE-2026-72899)

First seen 11 Aug 2026, 13:08 UTC • •76.5

Article Content

1 / 7

Browse articles

ThreatCluster •August 12, 2026 at 10:54 UTC

•CVE-2026-72899 is a critical SQL injection vulnerability in Metabase.
•The vulnerability affects versions 0.58.0 through 0.63.4 and has a CVSS score of 10.0.
•Attackers can exploit the flaw using only the public link UUID from shared dashboards.

CVE-2026-72899 is a critical unauthenticated SQL injection vulnerability affecting Metabase versions 0.58.0 to 0.63.4. The flaw allows attackers to execute arbitrary SQL queries against the Metabase application database by exploiting a publicly shared dashboard or saved question. An attacker only needs the public link UUID to exploit this vulnerability. The CVSS score for this vulnerability is 10.0, indicating its critical nature. The vulnerability arises from insufficient validation of parameter values in the public sharing endpoint. The flaw can lead to the leakage of sensitive data, including email addresses and password hashes. A patch has been developed to mitigate this issue by normalizing parameter values before SQL compilation. Immediate action is advised for affected users to prevent potential exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 50d ago How this analysis works

Timeline

2026-08-10

CVE-2026-72899 published

NVD published details for CVE-2026-72899, a critical SQL injection vulnerability in Metabase.

2026-08-11

Vulnerability disclosed

1dayexploit.com reported on the critical SQL injection vulnerability allowing unauthenticated access.

1dayexploit.com

2026-08-11

Urgent intervention recommended

CVE-2026-72899 is classified as a catastrophic security flaw, requiring immediate action from affected users.

More articles in this cluster (6)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Sql Injection
T1190 - Exploit Public-Facing Application

Organization (1)

Metabase

Vulnerability (1)

CVE-2026-72899

Weakness (1)

CWE-89 - SQL Injection

Relationships

CVE-2026-72899 related to Sql Injection
CVE-2026-72899 related to Metabase
CVE-2026-72899 related to CWE-89 - SQL Injection
CVE-2026-72899 related to T1190 - Exploit Public-Facing Application

Following this threat?

Track Metabase and CVE-2026-72899 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises…