KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2026-72898
Metabase · Metabase
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
Correlated Federal Court Cases & Exploitation Context (0)
No federal court indictment in the current archive directly cites CVE-2026-72898. This record tracks its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-08-11.
Associated Government Advisories
Tracked under CISA Known Exploited Vulnerabilities Binding Operational Directive 22-01 for federal civilian agency remediation.