Critical SQL Injection Vulnerability in Metabase (CVE-2026-72899)

CVE-2026-72899 is a critical unauthenticated SQL injection vulnerability affecting Metabase versions 0.58.0 to 0.63.4. The flaw allows attackers to execute arbitrary SQL queries against the Metabase application database by exploiting a publicly shared dashboard or saved question. An attacker only needs the public link UUID to exploit this vulnerability. The CVSS score for this vulnerability is 10.0, indicating its critical nature. The vulnerability arises from insufficient validation of parameter values in the public sharing endpoint. The flaw can lead to the leakage of sensitive data, including email addresses and password hashes. A patch has been developed to mitigate this issue by normalizing parameter values before SQL compilation. Immediate action is advised for affected users to prevent potential exploitation.

Key Points: • CVE-2026-72899 is a critical SQL injection vulnerability in Metabase. • The vulnerability affects versions 0.58.0 through 0.63.4 and has a CVSS score of 10.0. • Attackers can exploit the flaw using only the public link UUID from shared dashboards.