AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)

CVE-2026-72898: Metabase SQL Injection Vulnerability

criticalvulnerability🔥 Actively Exploited

security

Source: CISA Known Exploited VulnerabilitiesAugust 10, 2026CVE-2026-72898

Summary

Metabase has a SQL injection vulnerability (SQL injection, where an attacker inserts malicious SQL code into input fields) that allows an unauthenticated attacker to gain admin access to the application without logging in. Once inside, the attacker could steal database credentials, read sensitive data, change settings, and export information. This vulnerability is actively being exploited by real attackers.

Solution / Mitigation

Apply mitigations in accordance with vendor instructions from Metabase, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. For cloud services, follow BOD 26-04 guidance or discontinue use if mitigations are unavailable. See Metabase's security update at https://www.metabase.com/blog/security-update and the security advisory at https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf.