CVE-2026-72899

CVE

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

August 11, 2026

Last Seen

August 11, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical SQL Injection Vulnerability in Metabase (CVE-2026-72899)76.5

CVE-2026-72899 is a critical unauthenticated SQL injection vulnerability affecting Metabase versions 0.58.0 to 0.63.4. The flaw allows attackers to execute arbitrary SQL queries against the Metabase application database by exploiting a publicly shared dashboard or saved question. An attacker only ne...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical SQL Injection Vulnerability in Metabase (CVE-2026-72899)

Aug 11·3 sources

Related Articles (3)

CVE-2026-72899 AKAOMA CVE VULNERABILITIES / 10h Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

cve.akaoma.com·Aug 11

CVE-2026-72899: Metabase Unauthenticated SQL Injection 1dayexploit / 15h The vulnerability affects versions 0.58.0 through 0.63.4 and is caused by insufficient validation of parameter values in the public sharing endpoint. An attacker needs only the public link UUID (which is part of the shared URL by design) to execute arbitrary queries against the Metabase application database as a superuser.

1dayexploit.com·Aug 11

CVE-2026-72899 - Exploits & Severity

Related Entities

Sql Injection Metabase Cwe-89 - SQL Injection T1190 - Exploit Public-Facing Application