CVE-2026-72898

creationtimestamp| type| source ---|---|--- 2026-08-10 18:04:27+00:00| seen| https://infosec.exchange/users/wdormann/statuses/117072531713464991 2026-08-10 18:04:38+00:00| seen| https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3msqorw2bpc22 2026-08-10 18:56:56+00:00| seen|...

CVE-2026-72898

Metabase is affected by CVE-2026-72898. A remote, unauthenticated attacker can inject arbitrary SQL through the /reset_password endpoint, enabling administrator access to the connected Metabase instance. The cited sources describe the vulnerability and impact (admin access) but do not provide rem...