Singapore Warns That a Perfect-10 Metabase Flaw Is Still Being Used to Take Over Dashboards Without a Login
Singapore’s Cyber Security Agency warned on November 4 that attackers are still exploiting CVE-2026-72898, an unauthenticated SQL injection in Metabase’s password-reset function that can grant administrator access. Self-hosted instances on versions 58 through 63 need the point release for their branch.
A business-intelligence dashboard that talks to your warehouse is a high-value target. Singapore’s Cyber Security Agency said this week that attackers are still using a maximum-severity flaw in Metabase to inject SQL and become an administrator—without ever logging in.
The November 4 alert, AL-2026-158 from the Cyber Security Agency of Singapore, points to CVE-2026-72898 and to Metabase’s own August security update and advisory GHSA-vwf4-m7j8-wcjf. The walkthrough below follows those three documents.
A numbered look at the exposure
- What is broken. The flaw is an unauthenticated SQL injection in Metabase’s password-reset function. Singapore’s alert and the vendor advisory both describe an unauthenticated remote attacker injecting arbitrary SQL into the Metabase application database and gaining administrator access to the instance. The vendor rates it Critical, CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The temporary workaround, if you cannot upgrade at once, is to block the
/api/session/reset_passwordendpoint. - What an attacker can do after that. Metabase says an attacker who reaches administrator access can change the application configuration, steal stored credentials for connected databases, read data those connections can reach, and export data.
- Who still needs a patch. Singapore lists open-source builds from 0.58.0 up to, but not including, 0.58.24; 0.59.0 prior to 0.59.21; 0.60.0 prior to 0.60.17; 0.61.0 prior to 0.61.11; 0.62.0 prior to 0.62.9; and 0.63.0 prior to 0.63.5—plus the matching Enterprise 1.x lines. Metabase says versions below 58 are not vulnerable. The minimum safe point releases it names are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 (and the matching 1.x builds). You can confirm the running version from About Metabase in the gear or grid menu.
- Cloud versus self-hosted. Metabase wrote in August that Metabase Cloud was attacked with then-unknown (“0-day”) issue in versions 1.58 and above. The company said it blocked the endpoints used in that attack, patched the product, and that Cloud customers were already upgraded. Self-hosted operators have to apply the point release themselves.
- Why this is back in the news. Singapore said on November 4 that the vulnerability has been actively exploited and that a proof-of-concept exploit is publicly available. Metabase’s advisory also confirms active exploitation. The new hook is not a brand-new CVE; it is a reminder that instances which never took the August point release are still being hunted.
- A log pattern worth searching for. Metabase describes the attack pattern as a
POST /api/session/reset_passwordthat returns HTTP 400, followed by aGET /api/user/currentthat returns HTTP 200. Finding that sequence in application or ingress logs, the company says, means the instance has likely been compromised. - What to do after you upgrade a public instance. If the reset-password endpoint was reachable from untrusted networks, Metabase and Singapore both say to follow the vendor’s post-upgrade steps: revoke active sessions by deleting all rows in the
core_sessiontable; review API keys and remove any you do not recognize; review administrator accounts for unexpected changes; rotate credentials for connected databases; and check warehouse logs plus Metabase activity and query history for unauthorized access.
What this means for your company
Many small and mid-size firms stand up Metabase so sales, finance or operations can chart data without waiting on a report. That convenience often comes with stored warehouse passwords and a web interface that someone exposed “just for the team.” If that interface is on the internet and still sits below the August point release, an attacker does not need a stolen login to become an admin and reach the databases behind the charts. Inventory every Metabase you run—including forgotten Docker hosts and staging boxes—upgrade to the safe build for that branch, and treat any internet-facing copy that missed the patch as an incident until the session, admin, key and warehouse checks come back clean.
Not sure which Metabase instances you still run, or whether the password-reset page is reachable from the internet? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
