Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.
Metabase disclosed a maximum-severity SQL injection affecting versions x.58 through x.63 that lets unauthenticated attackers inject SQL via the /api/session/reset_password endpoint and gain administrator access to Metabase instances. Metabase Cloud was attacked, patches were released, and CISA added CVE-2026-72898 to the KEV catalog with a federal remediation deadline of August 14, 2026. Downstream victims include Framework (customer names, IPs, addresses, phone numbers, and emails accessed), n8n (136 customer records, five with bcrypt-hashed passwords), and Kilo Code (Slack access tokens). Wiz estimates roughly 13% of cloud environments run self-hosted Metabase, with about 2,500 instances internet-accessible.
- Workaround: block /api/session/reset_password, revoke sessions, review API keys, admin accounts, and database credentials.
- IoC pattern: POST /api/session/reset_password returning 400 followed by GET /api/user/current returning 200.
- Kilo Code said the Metabase incident ran about four hours on August 2, 2026, exposing Kilo Slackbot tokens.
- n8n also disclosed a historical 2023 bug that stored some cloud account passwords in plain text.
- Prior 2023 Metabase flaw CVE-2023-38646 enabled pre-auth RCE at CVSS 9.8.
- Products
- MetabaseMetabase Cloud
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's… | 9.8 | 99% | ||
| CVE-2026-72898 | Unauthenticated SQL Injection in Metabase Grants Admin Access | 10.0 | 99% | KEVPoC ×3 | KEV |
From the original article
4 min read at thehackernews.com
Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.