{"data":{"id":"e5add7bf-532d-4be1-a8e4-4d0e04e23391","title":"CVE-2026-72898: Metabase SQL Injection Vulnerability","summary":"Metabase has a SQL injection vulnerability (SQL injection, where an attacker inserts malicious SQL code into input fields) that allows an unauthenticated attacker to gain admin access to the application without logging in. Once inside, the attacker could steal database credentials, read sensitive data, change settings, and export information. This vulnerability is actively being exploited by real attackers.","solution":"Apply mitigations in accordance with vendor instructions from Metabase, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. For cloud services, follow BOD 26-04 guidance or discontinue use if mitigations are unavailable. See Metabase's security update at https://www.metabase.com/blog/security-update and the security advisory at https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72898","publishedAt":"2026-08-11T00:00:00.000Z","cveId":"CVE-2026-72898","cweIds":["CWE-89"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["Metabase"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"active","epssScore":0.0069,"patchAvailable":true,"disclosureDate":"2026-08-11T00:00:00.000Z","capecIds":["CAPEC-66"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":null}}