Back to the CVE list
CVE-2026-72898 CISA KEV · Actively exploitedSuited to automated attack · CISA

Metabase SQL injection via password reset endpoint

CVSS score

10.0

EPSS probability

%97.3

Risk score

19.5

Published

2 mo ago

OverviewPublic Exploits (12)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
4minx/CVE-2026-72898
GitHub

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection (★1)

Public PoCSource updated: 15.08.2026 19:12:50
G
EQSTLab/CVE-2026-72898
GitHub

Metabase SQLi (★1)

Public PoCSource updated: 27.08.2026 16:06:34
G
0xBlackash/CVE-2026-72898
GitHub

CVE-2026-72898 (★0)

Public PoCSource updated: 12.08.2026 22:59:37
G
codeb0ssx/CVE-2026-72898-PoC
GitHub

CVE-2026-72898 - Metabase (★0)

Public PoCSource updated: 14.08.2026 06:11:14
G
VuxNx/CVE-2026-72898
GitHub

PoC for CVE-2026-72898 (★0)

Public PoCSource updated: 15.08.2026 21:08:13
G
Franc-Zar/CVE-2026-72898-safe-detection
GitHub

Simple script to achieve safe and non-desruptive active detection of CVE-2026-72898 (SQLi in Metabase) (★0)

Public PoCSource updated: 16.08.2026 21:55:26
G
d-maggipinto/CVE-2026-72898-metabase-sqli
GitHub

Detector + root-cause analysis for CVE-2026-72898 (Metabase unauthenticated SQLi via reset_password) (★0)

Public PoCSource updated: 27.08.2026 03:37:53
G
34zY/CVE-2026-72898
GitHub

CVE-2026-72898 exploit (★0)

Public PoCSource updated: 14.09.2026 21:24:05
G
amier-ge/CVE-2026-72898
GitHub

CVE-2026-72898 Metabase SQL injection lab with vulnerable and patched versions, admin session creation, CSV export, order deletion, and recovery. (★0)

Public PoCSource updated: 07.10.2026 18:08:52
G
Riftweld/metabase-cve-2026-72898
GitHub

Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5) (★0)

Public PoCSource updated: 12.10.2026 10:03:28
G
gagaltotal/CVE-2026-72898-metabase
GitHub

CVE-2026-72898 Metabase Security Tools (★0)

Public PoCSource updated: 13.10.2026 18:16:04
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-72898.yaml
Nuclei

Nuclei: Metabase - Unauthenticated SQL Injection

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-72898"