THREATOPS
THREAT OPSThreat News › CVE-2026-72898 | Metabase Pre-Authentication SQL Injection Vulnerability

CVE-2026-72898 | Metabase Pre-Authentication SQL Injection Vulnerability

medhorizon3Published 2026-08-13

<p>CVE-2026-72898 is a critical unauthenticated SQL injection vulnerability in Metabase, a widely used open-source business intelligence and data analytics platform. Successful exploitation can give an attacker administrator access to the affected Metabase instance, allowing them to change application configuration, steal stored credentials for connected databases, read data accessible through tho

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-72898/