CVE-2026-72898Vulnerability
Metabase SQL Injection Vulnerability
Reported by 4 independent sources · first reported by Recorded Future · last reported
Last reported 2 days ago
Fix due 14 Aug 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
Behind Japan’s Warnings of a Cyber Crisis“Exploitation of CVE-2026-72898 (CVSS score 10), a SQL injection vulnerability, in the Metabase application;”
-
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks“The third pattern is exploitation of CVE-2026-72898, an SQL injection flaw in Metabase, an open-source BI tool that companies connect to their databases.”
-
14th September – Threat Intelligence Report“The attackers exploited CVE-2026-72898 in self-hosted tool Metabase to access an internal reporting database.”
-
Vulnérabilité dans Metabase (10 septembre 2026)“Référence CVE CVE-2026-72898”
-
August 2026 CVE Landscape“In August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).”
Indicators reported together
named in the same reports- idscan[.]netin 1 report
Copy this indicator · defanged
Also named with it: CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300, CVE-2026-33017, CVE-2017-0199, CVE-2022-0847, CVE-2026-85046, CVE-2026-85880, CVE-2026-34486, CVE-2026-39987, CVE-2026-63030, CVE-2021-3156, CVE-2021-29441, CVE-2026-3055, CVE-2026-12569
Thanks — we review every report.