Episode Details

A deep-dive on CVE-2026-72898, the unauthenticated SQL injection zero-day exploited against Metabase Cloud in early August 2026.

Two corrections to our roundup of 17 August, made on air. A CVE has since been assigned - CVE-2026-72898, added to CISA's Known Exploited Vulnerabilities catalogue on 11 August and rated 10.0 under both CVSS v3.1 and v4.0. And LexisNexis has explicitly ruled out any connection between its service outage and this flaw: the similarly-named Nexis Metabase API is an unrelated product, and LexisNexis is not a Metabase Cloud customer.

The timeline. 2 Aug: attacker active in Kilo Code's instance for about four hours. 3 Aug: broader attack on Metabase Cloud; Metabase detects, blocks and patches the same day. 6 Aug: public advisory; Framework notified, and notifies its own customers. 8 Aug: a researcher publishes a proof-of-concept lab. 10 Aug: CVE assigned; public exploits go open-source; Checkly and Wiz publish. 11 Aug: added to CISA KEV with a 14 August deadline; a second Metabase advisory covers further flaws; ShinyHunters lists Metabase on its leak site.

The vulnerability. An unauthenticated POST to /api/session/reset_password. Four individually correct behaviours chain together: Clojure's merge not stripping attacker-supplied keys when authentication fails; JSON keywordisation; HoneySQL's raw keyword, a deliberate feature that bypasses parameterisation; and a lookup that compiles the result into unparameterised SQL. The result is blind SQL injection against the application database, leading to a forged administrator session. As Checkly put it, no password was stolen. The patch is a three-line type check.

Exposure. Dataminr's 8 August scan found roughly 11,000 probable self-hosted instances, 4,309 likely vulnerable, and over 97% of fingerprinted hosts on an affected branch unpatched.

Five victims disclosed, all Metabase Cloud tenants, all of whom published their own post-mortems: Framework Computer (names, emails, login IPs, addresses, phone numbers; VAT and EIN for business customers), Tally (emails and hashed passwords), n8n (136 records, plus a separately-discovered 2023 plaintext password bug), Kilo Code and Anaconda (names, emails, billing addresses, user prompts, later Slack access tokens), and Checkly (26 minutes of read-only warehouse queries exposing plaintext credentials hard-coded into check configurations). Metabase has never said how many tenants were affected.

Attribution: unconfirmed. ShinyHunters listed Metabase on 11 August, but Dataminr assessed the listing as a placeholder with no scope named. Metabase has named nobody. Treat it as a claim.

Check your own instance. In application or ingress logs, look for a POST to /api/session/reset_password returning HTTP 400 immediately followed by a GET to /api/user/current returning HTTP 200. That pattern indicates likely compromise.

Five lessons. One: your BI tool is a production system holding a key ring - audit what it stores and scope those service accounts to read-only. Two: internet-facing auth endpoints on internal tools are an unforced error. Three: using the managed version is not the same as not being affected. Four: rotate sessions and downstream credentials, not just passwords - there was no malware, and both survive a patch. Five: use the secrets store, not free-text config fields.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: NVD and CVE.org; CISA KEV; Metabase advisories GHSA-vwf4-m7j8-wcjf and GHSA-r495-55cx-fjh7; Wiz; Bishop Fox; Dataminr; BleepingComputer; and disclosures by Checkly, n8n, Kilo Code, Framework and Tally.