Researchers Trace Metabase SQL Injection to Unchecked User-ID in Password-Reset Requests
Summary
Wiz researchers reverse engineered an actively exploited Metabase SQL injection flaw affecting versions 1.58 and later. They traced it to an unchecked user-id value in password-reset requests and urged self-hosted users to patch.
Key points
- Metabase disclosed the security incident on August 6, 2026; the flaw is tracked as CVE-2026-72898 and GHSA-vwf4-m7j8-wcjf.
- The SQL injection affects Metabase versions 1.58 and later and is reachable through /api/session/reset_password.
- Wiz traced the flaw to an attacker-supplied user-id surviving request merging when authentication fails, then reaching HoneySQL’s raw SQL feature.
- The injection can enable blind SQL injection; payloads depend on the database in use.
- Wiz observed publicly available proof-of-concept exploits by August 10 and withheld its own full PoC.
- Wiz estimated that 13% of cloud environments had self-hosted Metabase instances, and about a quarter of those were internet-accessible.
- Self-hosted Metabase users should patch promptly; Wiz advised customers to consult its Threat Intel Center advisory.
Article Details
- Attack Vectors
- An attacker exploited CVE-2026-72898, a SQL injection vulnerability in Metabase, through /api/session/reset_password by supplying an extra user-id JSON key containing a HoneySQL :raw value. The article reports exploitation against Metabase Cloud.
- The vulnerability affects Metabase versions 1.58 and later.
- Defensive Notes
- Patch self-hosted Metabase instances as soon as possible.
- Review /api/session/properties to determine whether an instance is running a vulnerable version.
- Use the Wiz Threat Intel Center advisory for investigation, remediation, and hardening guidance.