On August 6, 2026, Metabase disclosed a zero-day SQL Injection vulnerability identified as CVE-2026-72898 affecting the /api/session/reset_password API endpoint. The vulnerability arises because the API merges incoming JSON request data with authentication results without stripping unexpected keys, allowing an attacker to supply a crafted user-id parameter containing a HoneySQL :raw directive that injects arbitrary SQL. The flaw was introduced in version 1.58 during a refactor of the auth_identity module. The patch, available in versions after 1.58, adds validation to ensure user-id is a positive integer before use in SQL queries. Exploitation has been observed in the wild, with public proof-of-concept code released. Approximately 13% of cloud environments have self-hosted Metabase, with 25% of those instances internet accessible, increasing exposure risk. The vulnerability affects multiple database backends including H2, PostgreSQL, MySQL, and MariaDB. Organizations running vulnerable versions should patch immediately and investigate potential exploitation.

The vulnerability allows an attacker to perform blind SQL Injection on the Metabase platform via the reset_password API endpoint, potentially leading to unauthorized data access or manipulation. Given the injection occurs in a critical authentication-related API, exploitation could compromise user accounts or expose sensitive data. The vulnerability affects self-hosted Metabase instances starting from version 1.58. Public proof-of-concept exploits and observed in-the-wild exploitation increase the risk. Approximately 25% of self-hosted instances are internet-facing, elevating exposure. The impact is significant for organizations using vulnerable versions without patching, especially those with internet-accessible deployments.

A patch fixing this vulnerability is available in Metabase versions after 1.58. Organizations should immediately upgrade to a fixed version (at least 1.58.24 or later) to remediate the issue. The patch validates the user-id parameter to prevent SQL Injection. Self-hosted Metabase instances must be patched as soon as possible. Users should review their /api/session/properties endpoint to identify vulnerable versions and investigate any suspicious activity related to the reset_password API. The vendor advisory and Wiz Threat Intel Center provide detailed remediation and detection guidance. No indication exists that the vulnerability is mitigated without patching. There is no mention of cloud service remediation, so self-hosted instances require manual patching.