Critical Unauthenticated SQL Injection (CVE‑2026‑72898) in Metabase Enables Admin Takeover
What It Is — Metabase 0.x contains an unauthenticated remote SQL‑Injection flaw (CVE‑2026‑72898) that lets an attacker inject arbitrary SQL into the application database. Successful exploitation grants administrator privileges on the Metabase instance.
Exploitability — The vulnerability is publicly disclosed, requires no authentication, and can be triggered over the network. CVSS v3.1 base score 9.8 (Critical).
Affected Products — Metabase (open‑source business‑intelligence platform) – all supported versions prior to the vendor‑released patch (see CISA KEV).
Why It Matters for Trust & Control Assurance
- Access‑control assurance – An unauthenticated attacker can obtain admin rights, bypassing the organization’s identity‑and‑access safeguards.
- Configuration and credential protection – Once privileged, the adversary can alter Metabase settings, harvest stored database credentials, and exfiltrate downstream data, eroding the audit trail.
- Continuous control monitoring – Demonstrating that input‑validation controls are in place and that privileged‑access logs are collected is now a prerequisite for many enterprise procurement reviews.
Recommended Actions
- Apply the vendor‑released patch immediately; verify the version number.
- Conduct a rapid configuration review to ensure least‑privilege service accounts for Metabase and downstream databases.
- Enable detailed query‑logging and alert on anomalous SQL statements.
- Run a focused vulnerability scan on all Metabase instances to confirm remediation.
- Document the remediation steps in your control evidence repository for audit readiness.
Source: CISA KEV – CVE‑2026‑72898