Summary
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
- Vendor
- Metabase
- Product
- Metabase
- Added to KEV
- Aug 11, 2026
- Remediation due
- Aug 14, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-89
- EPSS
- 98.2% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References