CVE-2026-72899
Awaiting Analysis Awaiting Analysis - Queue

SQL Injection in Metabase via Publicly Shared Dashboard

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-26
Generated
2026-08-31
AI Q&A
2026-08-11
EPSS Evaluated
2026-08-29
NVD
CVE-2026-72899
EUVD
EUVD-2026-55691

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
metabase metabase From x.58.0 (inc) to x.58.24 (exc)
metabase metabase From x.59.0 (inc) to x.59.21 (exc)
metabase metabase From x.60.0 (inc) to x.60.17 (exc)
metabase metabase From x.61.0 (inc) to x.61.11 (exc)
metabase metabase From x.62.0 (inc) to x.62.9 (exc)
metabase metabase From x.63.0 (inc) to x.63.5 (exc)
metabase metabase *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Metabase allows an unauthenticated attacker to inject arbitrary SQL code through a publicly shared card or dashboard that uses a field-filter (dimension) parameter. This means an attacker can manipulate the parameter to execute unauthorized database queries without needing to log in.

Detection Guidance

Detecting this vulnerability requires checking for publicly shared Metabase cards or dashboards with field-filter parameters. Inspect Metabase logs for unusual SQL queries or unauthorized data access patterns. Look for requests containing dimension parameters in shared links.

Impact Analysis

This vulnerability can lead to severe impacts such as unauthorized data access, data manipulation, or complete database compromise. Attackers could steal sensitive information, alter or delete data, or even take control of the entire Metabase instance and underlying database.

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to personal or sensitive data. It may result in data breaches, leading to legal penalties, fines, reputational damage, and loss of trust from customers or partners.

Mitigation Strategies

Disable public sharing of cards and dashboards in Metabase. Review and revoke any existing public shares. Update Metabase to the latest version if a patch is available. Monitor for suspicious SQL injection attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart