CERT-FR warns of mass Metabase SQLi exploitation

10 September 2026 high vulnerability technology

An unauthenticated SQL injection in Metabase (CVE-2026-72898) grants admin rights and is being actively exploited, with CERT-FR aware of numerous compromises.

CERT-FR issued an alert on a critical unauthenticated SQL injection vulnerability in Metabase (CVE-2026-72898), disclosed by the vendor on 6 August 2026. The flaw allows an unauthenticated attacker to inject SQL into the application's database backend, ultimately obtaining administrator privileges over the Metabase instance. CERT-FR states it is aware of numerous real-world compromises of vulnerable Metabase deployments, indicating active exploitation in the wild.

Affected versions include all Metabase releases prior to x.58.28, x.63.10, and specific ranges within x.59.x, x.60.x, x.61.x, and x.62.x branches prior to their respective patched versions. Exploitation attempts can be identified in application and Metabase logs via a characteristic sequence: a POST request to /api/session/reset_password returning HTTP 400, followed by a GET request to /api/user/current returning HTTP 200.

Defenders should patch immediately per the vendor advisory. If patching is not immediately possible, CERT-FR/Metabase recommend blocking public access to /api/session/reset_password. If that endpoint has been publicly exposed, organizations should treat the instance as potentially compromised: revoke all active sessions (clear the core_session database table), review and remove unrecognized API keys, audit administrator accounts for unexpected changes, rotate credentials for all connected databases, and review logs and query/activity history for signs of unauthorized access. Any confirmed compromise should be reported to CERT-FR.

Mentioned in this report

Vulnerabilities CVE-2026-72898KEV

Detection guidance

Metabase Unauthenticated SQLi Exploitation Attempt

ATT&CK T1190

Detects characteristic HTTP request sequence indicative of CVE-2026-72898 exploitation: POST to /api/session/reset_password returning 400, followed by GET to /api/user/current returning 200. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Metabase Unauthenticated SQLi Exploitation Attempt
description: 'Detects the characteristic two-request sequence of CVE-2026-72898 SQLi
  exploitation in Metabase: POST /api/session/reset_password (HTTP 400) followed by
  GET /api/user/current (HTTP 200). This pattern indicates an unauthenticated attacker
  attempting to inject SQL and escalate to admin privileges.'
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: generic
detection:
  selection_reset_password:
    http_method: POST
    uri|contains: /api/session/reset_password
    http_status: 400
  selection_user_current:
    http_method: GET
    uri|contains: /api/user/current
    http_status: 200
  filter_same_source:
    c_ip: null
  condition: selection_reset_password and selection_user_current and not filter_same_source
falsepositives:
- Users legitimately resetting passwords followed by checking their profile in quick
  succession
- Automated health checks or monitoring tools probing multiple Metabase endpoints
level: high
id: 80b347a3-b85f-523c-81df-e184057a79ff
status: experimental
author: Vorant

Metabase Unauthorized Administrator Account Creation

ATT&CK T1078

Detects database writes to Metabase core_user table creating or modifying admin accounts, indicative of post-exploitation privilege escalation after SQLi. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Metabase Unauthorized Administrator Account Creation
description: Detects insertion or modification of administrator accounts in the Metabase
  core_user table, a post-exploitation activity following successful SQLi. Targets
  INSERT or UPDATE statements modifying the is_superuser or email fields with admin=true
  patterns.
tags:
- attack.persistence
- attack.t1078
- attack.t1190
logsource:
  category: database_query
  product: metabase
detection:
  selection:
    query|contains:
    - is_superuser = true
    - is_superuser'=true
  filter_migration:
    query|contains:
    - migration
    - flyway
  condition: selection and not filter_migration
falsepositives:
- Legitimate admin account provisioning during initial setup or user onboarding
- Automated database migration or schema management tools
level: high
id: e758a752-4d56-5634-b454-2fb87aaf7289
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-010

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free