vulns.cofield index
Enter
Search
LanguageEN
EnglishCurrentEspañolSame sectionPortuguês (Brasil)Same sectionFrançaisSame sectionDeutschSame section日本語Same section简体中文Same section
Learning
Browse all pagesCurrent: Intelligence
Known vulnerability record

CVE-2026-72898

Metabase SQL Injection Vulnerability

Stable IDcve:CVE-2026-72898Source record dateHuman reviewNot recordedProvenanceSource-linked CVE, KEV, and EPSS signals
Summary

Metabase SQL Injection Vulnerability

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Vulns.co field classification

Interpreter injection on enterprise application

Derived analysis: these labels are inferred from the source title, product, and summary. They are not vendor, CVE, CISA, or FIRST classifications.

Failure classInterpreter injection
Product laneEnterprise application
Attention stateKnown exploited, ransomware use unknown
Hunter pivot

Locate each parser boundary before choosing a probe. Vary one delimiter or encoding at a time, use non-destructive canaries, and distinguish interpreter behavior from generic errors.

Signals

Keep the signals separate

CVSS severitycriticalScore 10 · source cisa-cg
EPSS probability94.2%Probability of exploitation in the next 30 days; not severity
CISA KEVKnown exploitedAdded 2026-08-11
Ransomware useunknownPreserved as known / unknown, not a truthy default
Research boundary

Confirm the product before the behavior.

  1. Match the exact product, build, deployment mode, and exposed component.
  2. Read the vendor advisory and current program policy.
  3. Choose one non-destructive discriminator with an explicit negative control.
  4. Stop at the first sufficient proof. A CVE match is context, not permission.
Timeline

Dates and provenance

CVE published
2026-08-10
CVE modified
2026-08-12
KEV date added
2026-08-11
Dataset fetched
2026-09-07T13:17:12.496Z
Sources

Original records

Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.