CVE Catalog
CVE-2026-72898
CriticalCVSS 10.0Summary
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Risk Assessment
An attacker can gain full administrator privileges, leading to complete compromise of the Metabase instance and data.
Recommendation
Apply available security patches for Metabase and restrict access to the password reset endpoint.
Original NVD description (English source)
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.