Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
NVD: Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Monitor for unauthenticated POSTs to the /api/session/reset_password endpoint carrying a user-id raw-map that inject blind SQL into the Metabase application database.
PreconditionsUnauthenticated network access to a Metabase instance running a vulnerable version (0.58.x through 0.63.x; fixed in 0.58.24/0.62.9); attacker POSTs JSON carrying a user-id raw-map to /api/session/reset_password; blind SQL injection against the application database (H2 default, PostgreSQL/MySQL/MariaDB in production) yields admin session takeover. agent
DeliveryHTTP POST to /api/session/reset_password with crafted JSON user-id raw-map
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 10.0) | Exploited in the wild against Metabase Cloud (disclosed 2026-08-06); public PoCs open-sourced by 2026-08-10; affected versions 0.58.x-0.63.x, fixed in 0.58.24/0.62.9
SummaryUnauthenticated SQL injection in the /api/session/reset_password endpoint of Metabase (0.58.x-0.63.x) lets a remote attacker gain administrator access via a HoneySQL raw-map user-id injection. Exploited in the wild against Metabase Cloud; public PoCs exist. Fixed in 0.58.24/0.62.9.
Tia coverage
First reported2026-08-10
First exploit report2026-08-12
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.