A CVSS 10.0 Metabase zero-day handed admin access through the password reset endpoint

Metabase disclosed CVE-2026-72898 on August 8, 2026, a CVSS 10.0 flaw that lets a remote, unauthenticated attacker inject arbitrary SQL through the /api/session/reset_password endpoint and obtain administrative access with no credentials. From there an attacker can change configuration, read the database credentials Metabase stores for every connected data source, and export data. Exploitation in the wild dates to roughly August 2, 2026, first observed against Metabase's own cloud service. Affected builds span 1.58.0 through 1.63.3 across six release lines, patched in 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. CISA added it to the Known Exploited Vulnerabilities catalog on August 11.

Why it matters

The endpoint matters as much as the severity. Password reset is by design reachable before authentication, which makes it one of a handful of pre-auth attack surfaces that exist on nearly every application, and it is routinely under-tested because it sits outside the authenticated code paths that get the security review. Metabase compounds it: a business intelligence tool is a credential vault by another name, holding connection strings to every warehouse and production replica it queries. Admin access there is lateral movement into the data layer. Patch, then assume the stored credentials leaked: block the endpoint at the proxy, rotate every connected database credential, revoke sessions and API keys, and review the query log. Rotating downstream secrets is the step teams skip. See secrets rotation.

Source: The Hacker News