CVE-2026-72898: Metabase SQL Injection Under Active Exploitation — Detection and Remediation Guide

On August 11, 2026, CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities (KEV) catalog, confirming what many SOC teams have already suspected from their own telemetry: a SQL injection vulnerability in Metabase is being actively exploited in the wild. This is not a theoretical risk. This vulnerability allows an unauthenticated remote attacker to inject arbitrary SQL statements into the Metabase application database — and from that foothold, the impact escalates rapidly.

The attack chain is particularly dangerous because of what Metabase is: a business intelligence platform that, by design, holds connection credentials to your most valuable data stores. An attacker who gains administrative control of a Metabase instance can:

• Modify application configuration (including SMTP, LDAP, and authentication settings)
• Steal stored credentials for every connected database the instance queries
• Read any data accessible through those connections
• Export data in bulk, directly through legitimate application functionality

If your organization runs Metabase — self-hosted, in Docker, or on an internally exposed VM — treat this as an active incident until proven otherwise. Under BOD 26-04 (Prioritizing Security Updates Based on Risk), federal civilian executive branch agencies are mandated to remediate KEV-listed vulnerabilities within defined timelines, and every private-sector organization should hold itself to the same standard. CISA's accompanying Forensics Triage guidance is a signal in itself: assume compromise may already have occurred and hunt accordingly.

Technical Analysis

Affected Product

How the Vulnerability Works (Defender's View)

The flaw is a classic but devastating unauthenticated SQL injection reachable through a remotely accessible application endpoint. The injected SQL executes against the Metabase application database — the internal store (H2 by default in naive deployments, or PostgreSQL/MySQL in production-grade installs) that holds user accounts, session tokens, dashboard definitions, and — critically — encrypted connection details for every database the instance is configured to query.

The typical post-exploitation chain we expect responders to encounter:

1. Injection — Attacker submits crafted input to a vulnerable unauthenticated endpoint; SQL is executed in the context of the Metabase service account against the application database.
2. Privilege escalation within the app — The attacker inserts or modifies a user record to grant themselves administrator privileges (or extracts/reset an existing admin's session token).
3. Configuration manipulation — With admin access, the attacker can alter SMTP/notification settings, disable logging integrations, create persistence accounts, or weaken authentication.
4. Credential harvesting — Metabase stores connection strings and credentials for connected warehouses (Postgres, MySQL, Snowflake, Redshift, BigQuery, SQL Server, etc.). Admin access enables decryption/extraction of these secrets.
5. Data access and exfiltration — Using legitimate Metabase query and export functionality, the attacker reads and exports any data reachable through stored connections. This traffic looks like normal application behavior unless you know where to look.

The most insidious aspect: post-compromise activity largely blends into legitimate BI traffic. The injection itself is your best detection window, followed by anomalous admin-level actions and large export operations.

Why This Is Severe

• Unauthenticated — no credential theft, phishing, or insider access required. Internet-exposed instances are directly targetable.
• Active exploitation confirmed — KEV listing means CISA has reliable evidence of in-the-wild abuse.
• Blast radius extends beyond Metabase — every database credential stored in the instance must be considered compromised.
• Default deployments are fragile — instances still running the embedded H2 application database on an exposed port are especially common in shadow-IT and developer environments.

Detection & Response

The detections below target the two highest-signal phases: (1) the injection attempt itself in web/proxy logs, and (2) post-exploitation behavior — suspicious process execution by the Metabase JVM, anomalous admin/API activity, and bulk data export. Tune thresholds to your baseline; Metabase legitimately generates database queries, so focus on anomalies in source, volume, and administrative action type.

Sigma Rules

---
title: Metabase Unauthenticated SQL Injection Attempt in Web Access Logs
id: 3f8a1c94-7b2d-4e61-9a05-cve2026f2898
status: experimental
description: Detects SQL injection patterns in HTTP requests directed at Metabase API endpoints, consistent with exploitation of CVE-2026-72898. Review web server, reverse proxy, or WAF logs fronting Metabase instances.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/11
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: generic
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/api/'
      - '/api/util/'
      - '/api/session/'
      - '/api/user/'
  selection_sqli:
    cs-uri-query|contains:
      - '%27'  # URL-encoded single quote
      - '%22'  # URL-encoded double quote
      - 'UNION%20SELECT'
      - 'union+select'
      - 'OR%201%3D1'
      - 'SLEEP('
      - 'pg_sleep'
      - 'information_schema'
      - 'WAITFOR%20DELAY'
  condition: selection_uri and selection_sqli
falsepositives:
  - Vulnerability scanners and authorized penetration tests
  - QA automation sending malformed queries
level: high
---
title: Metabase JVM Spawning Suspicious Child Processes
id: 9c4d2e71-5a38-4f90-b1c7-88a2d3e6f501
status: experimental
description: Detects the Java process hosting Metabase spawning shells or command interpreters, a strong indicator of post-exploitation command execution or reverse-shell staging following SQL injection compromise (CVE-2026-72898).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/11
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'metabase.jar'
      - 'metabase'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; Metabase's JVM should not spawn shells in normal operation
  - Container health-check wrappers invoking curl (tune by image name)
level: critical
---
title: Anomalous Bulk Export or Admin API Activity on Metabase Instance
id: 6b1e8a53-2d94-47c0-a3f1-e4c5d8b2a907
status: experimental
description: Detects high-volume export/download API calls or admin-level configuration changes against Metabase from non-standard source IPs, consistent with post-compromise data exfiltration following CVE-2026-72898 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/11
tags:
  - attack.exfiltration
  - attack.t1530
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-stem|contains:
      - '/api/card/'
      - '/api/dataset/'
      - '/api/download/'
      - '/api/admin/'
      - '/api/setting/'
      - '/api/database/'
    sc-status:
      - 200
      - 201
  filter_authorized_sources:
    c-ip|startswith:
      - '10.'
      - '192.168.'
  condition: selection and not filter_authorized_sources
falsepositives:
  - Remote analysts legitimately exporting reports over VPN (tune source IP list)
  - Scheduled reporting integrations
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts proxy/WAF/firewall logs (ingested via CEF/Syslog) for SQL injection indicators against Metabase API paths, then correlates with large response sizes that may indicate data exfiltration through export endpoints.

// Hunt: Metabase CVE-2026-72898 — injection attempts and anomalous export activity
// Data sources: CommonSecurityLog (proxy/WAF), Syslog (nginx/HAProxy access logs)
let sqli_patterns = dynamic(["%27", "UNION%20SELECT", "union+select", "OR%201%3D1", "SLEEP(", "pg_sleep", "information_schema", "WAITFOR%20DELAY"]);
let mb_api_paths = dynamic(["/api/", "/api/card/", "/api/dataset/", "/api/download/", "/api/admin/", "/api/setting/", "/api/database/", "/api/user/", "/api/session/"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any (mb_api_paths)
| extend InjectionAttempt = RequestURL has_any (sqli_patterns)
| extend BytesSent = tolong(SentBytes)
| summarize
    Requests = count(),
    InjectionAttempts = countif(InjectionAttempt),
    TotalBytesSent = sum(BytesSent),
    DistinctPaths = dcount(RequestURL)
    by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| where InjectionAttempts > 0 or TotalBytesSent > 50000000  // >50MB/hour from a single source
| sort by InjectionAttempts desc, TotalBytesSent desc;

// Companion hunt: process execution on Metabase hosts (via Syslog/Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessCommandLine has_any ("metabase.jar", "metabase")
| where FileName in~ ("bash", "sh", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "base64")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, RemoteIP
| sort by TimeGenerated desc;

Velociraptor VQL

Use this hunt across hosts running Metabase to identify post-exploitation process execution and unexpected outbound connections from the Java process — indicators that injected SQL was used to stage further tooling or pivot to connected databases.

-- Hunt: Metabase post-exploitation indicators (CVE-2026-72898)
-- Identifies shells/tools spawned under the Metabase JVM and anomalous outbound connections

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()
  WHERE CommandLine =~ '(?i)metabase'
     OR Exe =~ '(?i)metabase';

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE Ppid IN (SELECT Pid FROM procs)
    AND Name =~ '(?i)(bash|sh|dash|python|perl|curl|wget|nc|ncat|socat|base64|crontab)';

SELECT * FROM suspicious_children
UNION ALL
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime FROM procs
WHERE CommandLine =~ '(?i)(-Djava|jar)';  -- confirm the Metabase process baseline

-- Network connections from the Metabase JVM to unexpected destinations
SELECT Pid, Name, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)java'
  AND Status = 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'

Remediation & Verification Script

Run this on self-hosted Linux/Docker Metabase hosts to inventory the deployment, check the running version, and apply immediate hardening controls while scheduling the vendor patch.

#!/usr/bin/env bash
# CVE-2026-72898 - Metabase emergency triage & hardening script
# Run as root on Metabase hosts. Review output before restarting services.
set -euo pipefail

echo "=== [1] Identify running Metabase processes and version ==="
ps aux | grep -i metabase | grep -v grep || echo "No bare-metal Metabase process found."

echo "=== [2] Docker deployments ==="
if command -v docker &>/dev/null; then
  docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep -i metabase || echo "No Metabase containers running."
fi

echo "=== [3] Check for exposed Metabase port (default 3000) ==="
ss -tlnp | grep -E ':(3000)\b' || echo "Port 3000 not listening locally."

echo "=== [4] Pull latest patched Metabase image (verify tag against vendor advisory first) ==="
echo "ACTION REQUIRED: Confirm the fixed version tag at https://www.metabase.com/security and the CISA KEV entry for CVE-2026-72898"
# docker pull metabase/metabase:<PATCHED_VERSION>

echo "=== [5] EMERGENCY MITIGATION: Restrict network access to Metabase ==="
# Block all inbound access except from your trusted admin/VPN subnet until patched.
# Adjust 10.0.0.0/8 to your management range.
iptables -C INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT 2>/dev/null || \
iptables -I INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -C INPUT -p tcp --dport 3000 -j DROP 2>/dev/null || \
iptables -A INPUT -p tcp --dport 3000 -j DROP
echo "iptables rules applied. Persist them per your distro (iptables-save / netfilter-persistent)."

echo "=== [6] Snapshot application DB config location ==="
find / -name 'metabase.db.mv.db' -o -name 'metabase.db' 2>/dev/null | head -5
echo "WARNING: Embedded H2 application DB detected above -> plan migration to PostgreSQL per vendor hardening guidance."

echo "=== [7] Evidence preservation for IR (per CISA Forensics Triage guidance) ==="
EVIDENCE_DIR="/var/tmp/metabase_ir_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$EVIDENCE_DIR"
cp -a /var/log/nginx/ "$EVIDENCE_DIR/" 2>/dev/null || true
cp -a /var/log/apache2/ "$EVIDENCE_DIR/" 2>/dev/null || true
docker logs --since 720h $(docker ps -q --filter name=metabase) > "$EVIDENCE_DIR/metabase_container.log" 2>/dev/null || true
echo "Evidence staged at $EVIDENCE_DIR — preserve before any rebuild."

echo "=== NEXT STEPS ==="
echo "1. Upgrade to the vendor-fixed Metabase version immediately."
echo "2. Rotate ALL credentials stored in Metabase (database connections, LDAP, SMTP, API keys)."
echo "3. Review Metabase admin users, sessions, and audit logs for unauthorized accounts."
echo "4. If internet-exposed and unpatched prior to 2026-08-11: assume compromise, initiate IR."

Remediation

Immediate Actions (Within 24 Hours)

1. Apply the vendor patch. Follow the official Metabase advisory and CISA KEV entry for CVE-2026-72898. Verify you are running the fixed version — do not rely on "latest" tags without confirming the patched build number in the vendor's release notes. KEV-listed vulnerabilities carry remediation deadlines under BOD 26-04 for federal agencies; private organizations should treat the same timeline as binding best practice.
2. Remove internet exposure. Metabase is an internal analytics tool. It should never be directly reachable from the internet. Place it behind authenticated VPN, ZTNA, or at minimum an IP allowlist and SSO-enforcing reverse proxy.
3. Rotate every secret Metabase holds. Because exploitation grants access to stored connection credentials, rotate: all connected database passwords/service accounts, LDAP bind credentials, SMTP credentials, API keys, and cloud warehouse tokens (Snowflake, BigQuery, Redshift, etc.). Assume all are compromised if the instance was exposed.
4. Force session invalidation. After patching, invalidate all active sessions and reset admin passwords through the application.

Compromise Assessment (Per CISA Forensics Triage Guidance)

CISA's reference to forensic triage in the required-action language is deliberate. For any instance that was network-reachable while vulnerable:

• Review web/proxy logs for injection patterns against /api/ endpoints (see Sigma/KQL above).
• Audit Metabase's internal user and group tables for unauthorized admin accounts or permission changes.
• Review application audit logs for anomalous query, export, or configuration-change activity — especially bulk exports and new database connections added post-baseline.
• Preserve logs and container images before upgrading or rebuilding; a patched system with wiped logs is a lost investigation.

Long-Term Hardening

• Migrate off the embedded H2 application database to a dedicated PostgreSQL instance with least-privilege service accounts — this limits what injected SQL can reach.
• Run Metabase under a dedicated, non-root service account with no shell access; containerize with a read-only filesystem where possible.
• Segment data connections — connect Metabase to databases using read-only accounts scoped to only the schemas analytics actually needs. Stored credentials with write or admin rights convert a Metabase compromise into a full database compromise.
• Enable and centralize Metabase audit logging to your SIEM so admin actions and exports are monitored independently of the application.
• Add Metabase version tracking to your asset inventory — shadow BI deployments spun up by engineering teams are consistently the last to be patched.

Verification Checklist

• Patched Metabase version confirmed via /api/health or admin panel
• No direct internet exposure (validated with external scan)
• All stored credentials rotated
• All sessions invalidated, admin accounts audited
• Detection rules deployed; 14-day retro hunt completed
• Evidence preserved for instances exposed while vulnerable

Bottom Line

CVE-2026-72898 is the worst kind of vulnerability for a BI platform: unauthenticated, actively exploited, and aimed squarely at a system whose entire purpose is to hold keys to your data. The injection is the entry point — the real prize is everything downstream. Patch now, rotate everything, and hunt backward at least two weeks. If you find evidence of exploitation, this stops being a patching exercise and becomes an incident response engagement.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub