A CVSS 10.0 Metabase zero-day handed admin access through the password reset endpoint
CVE-2026-72898 lets an unauthenticated attacker inject SQL through Metabase's password reset endpoint and take administrative control. It was exploited as a zero-day around August 2, 2026 and added to CISA KEV on August 11.
Metabase disclosed CVE-2026-72898 on August 8, 2026, a CVSS 10.0 flaw that lets a remote, unauthenticated attacker inject arbitrary SQL through the /api/session/reset_password endpoint and obtain administrative access with no credentials. From there an attacker can change configuration, read the database credentials Metabase stores for every connected data source, and export data. Exploitation in the wild dates to roughly August 2, 2026, first observed against Metabase's own cloud service. Affected builds span 1.58.0 through 1.63.3 across six release lines, patched in 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. CISA added it to the Known Exploited Vulnerabilities catalog on August 11.
Why it matters
The endpoint matters as much as the severity. Password reset is by design reachable before authentication, which makes it one of a handful of pre-auth attack surfaces that exist on nearly every application, and it is routinely under-tested because it sits outside the authenticated code paths that get the security review. Metabase compounds it: a business intelligence tool is a credential vault by another name, holding connection strings to every warehouse and production replica it queries. Admin access there is lateral movement into the data layer. Patch, then assume the stored credentials leaked: block the endpoint at the proxy, rotate every connected database credential, revoke sessions and API keys, and review the query log. Rotating downstream secrets is the step teams skip. See secrets rotation.
Source: The Hacker News
Related on Start with Identity
- BlogA loose PHP comparison let attackers sign in as WordPress admin through SAML
Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signat
- BlogA Zimbra XSS zero-day let a Russian espionage group read mailboxes and steal 2FA codes for months
NSA, CISA, and partner agencies detailed a year-long campaign against Zimbra Classic UI, tracked under several names including Void Blizzard and LAUNDRY BEAR, t
- BlogForged OIDC tokens in SimpleHelp RMM handed out technician access to 1,000 exposed servers, no MFA required
CVE-2026-48558 lets an unauthenticated attacker forge OpenID Connect tokens against SimpleHelp remote-monitoring software configured for group login, gaining pr
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo