CVE-2026-72898

Description

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Proof of Concept (POC) Links

Explore how this vulnerability can be reproduced or exploited.

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898