What happened
Metabase, the widely used open-source business intelligence tool, disclosed a maximum-severity vulnerability on August 8 that attackers were already exploiting. Tracked as CVE-2026-72898 and scored a perfect 10.0 on the CVSS scale, the flaw is a SQL injection bug in the password-reset endpoint. An attacker needs no account and no credentials: by injecting SQL through the reset_password database endpoint, they can grant themselves administrator access. Metabase said it identified exploitation against its own Metabase Cloud service, and companies including Framework, n8n, and Kilo Code were named among those affected. Cloud security firm Wiz observed roughly 2,500 Metabase instances reachable from the open internet. Metabase shipped fixed releases across all six supported version branches.
Why it matters for your business
Plenty of small companies run Metabase because it is a free, friendly way to build dashboards on top of a sales or operations database. That convenience cuts the other way here. An attacker who becomes a Metabase admin can read the stored database connection credentials, browse and export everything the tool can reach, and quietly change configuration. If your dashboards touch customer lists, invoices, or payroll data, this one flaw exposes all of it. Self-hosted software does not patch itself, and this endpoint is exposed even on instances nobody logs into anymore.
What to do about it
If you or your IT provider run Metabase, treat this as urgent:
- Upgrade to the latest patch release for your version branch immediately
- If you cannot patch today, temporarily block the /api/session/reset_password endpoint at your firewall or proxy
- Revoke active sessions and review the list of administrator accounts for anything unfamiliar
- Rotate the database credentials Metabase stores, since attackers who got in may have copied them
- Check access logs for suspicious password-reset traffic