Singapore CSA warns that Metabase CVE-2026-72898 (unauthenticated SQL injection → admin, CVSS 10.0) is being actively exploited; patch or block /api/session/reset_password now
- Who is exposed: any self-hosted Metabase whose reset-password API is reachable from untrusted networks — especially internet-facing instances.
- Immediate actions: upgrade to the fixed build for your major version; if you cannot upgrade tonight, block
/api/session/reset_passwordat the reverse proxy/WAF. - After upgrade on a previously public instance (per Metabase): delete all rows in
core_session, review/delete unrecognized API keys, review admin accounts, rotate credentials for connected databases, and check Metabase query history plus warehouse logs for unexpected access. GreyNoise had already been seeing elevated Metabase probing before the CSA note (see our earlier hunt).
Sources: Singapore CSA AL-2026-158: Active Exploitation of Metabase Vulnerability (Nov 4) · Metabase GHSA-vwf4-m7j8-wcjf: SQL injection using an unauthenticated endpoint leading to admin access