What Happened (Plain English)
High-risk Metabase Metabase weakness requires patching (CVE-2026-72898) affects Metabase Metabase. FIRST EPSS telemetry places exploitation probability at 98.21%. With a CVSS score of 10.0 (CRITICAL), security teams should verify affected deployments and prioritize remediation according to exposure.
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. Unpatched internet-facing or user-accessible instances risk unauthorized execution, data exposure, or service disruption.
Affected Software & Weakness
Vendor: Metabase · Product: Metabase · Versions: Metabase x.58.0, Metabase x.58.24, Metabase x.59.0 · CWE: CWE-89
The Fix
Verify your installed Metabase version against Metabase's official security bulletin for CVE-2026-72898, apply the patched build in a staging ring first when possible, and confirm rollout across all production nodes.
Temporary Workarounds
If patching Metabase Metabase cannot happen today, place management ports behind VPN or zero-trust access, restrict untrusted network ingress, and enforce multi-factor authentication on administrative sessions.
Detection & Log Checks
Inspect Metabase application logs, perimeter firewall denies/allows, and EDR process trees for unusual child processes or outbound connections correlated with CVE-2026-72898 (CWE-89).
Frequently Asked Questions
Is CVE-2026-72898 actively exploited?
No KEV listing yet, but EPSS exploitation probability is 98.21%.
What is the fix for CVE-2026-72898?
Upgrade Metabase to >= x.58.24 (CVE-2026-72898 vendor patch).
Which Metabase products are affected?
Metabase Metabase (Metabase x.58.0, Metabase x.58.24, Metabase x.59.0).
How urgent is patching CVE-2026-72898?
Priority queue: THIS-WEEK (CVSS 10.0, EPSS 98.21%).
Official References
- https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
- https://www.metabase.com/blog/security-update
- https://www.cve.org/CVERecord?id=CVE-2026-72898
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json
Last verified: 2026-11-13 · Defensive checklist only.