Critical Metabase SQL Injection Exposes Enterprise Data Warehouses via Password Reset

Security researchers have detailed CVE-2026-72898, a critical CVSS 10.0 unauthenticated SQL injection vulnerability affecting self-hosted Metabase instances across versions 0.58 through 0.63. The issue originates in the platform's password-reset functionality at the publicly exposed POST /api/session/reset_password endpoint. Due to improper restriction of undeclared fields during query construction, an external attacker can submit structured query objects—specifically raw expressions in the query builder—within the JSON request body. This allows remote, unauthenticated actors to execute arbitrary SQL directly against Metabase's underlying application database, a flaw already confirmed to be under active exploitation. The operational fallout from this vulnerability goes significantly beyond the compromise of the dashboard server itself. Because Metabase functions as a centralized business intelligence gateway, an attacker who manipulates the application database to gain administrative access can harvest stored database credentials, alter instance configurations, and execute queries against connected internal infrastructure. As a result, an unauthenticated perimeter request directly translates into deep lateral access across production databases, transactional systems, and cloud data warehouses. This incident illustrates a persistent architectural vulnerability in modern data architectures. As engineering teams deploy self-hosted analytics engines to maintain governance over proprietary data, these tools frequently end up exposed on corporate networks with high-privilege read access across diverse datastores. Furthermore, the root cause underscores an evolving AppSec challenge: relying on dynamic query builders or object-relational abstraction layers without enforcing strict input schema validation at the HTTP layer can inadvertently introduce critical injection vectors even in modern web stacks. Platform and AppSec engineers should prioritize upgrading self-hosted Metabase instances to the latest vendor release immediately, given the active exploitation confirmed by CISA and security researchers. If immediate redeployment is not feasible, edge proxies and web application firewalls should be configured to temporarily block external access to the /api/session/reset_password route. In parallel, security teams must audit Metabase audit logs and warehouse connection query histories for unauthorized access tokens, configuration tampering, or anomalous data exports during the exposure window.