Skip to main content
عربي
logo

NCSC-VD-2608-002-02

Severity Level: Critical

Reference No.: NCSC-VD-2608-002-02

Metabase

Description

CVE-2026-72898: An unauthenticated remote attacker can inject arbitrary SQL into the Metabase application database through /api/session/reset_password and gain administrator access to the instance.

Vulnerabilities

  • CVE-2026-72898

    An unauthenticated remote attacker can inject arbitrary SQL into the Metabase application database through /api/session/reset_password and gain administrator access to the instance.

References