---
title: Singapore CSA warns that Metabase CVE-2026-72898 (unauthenticated SQL injection → admin, CVSS 10.0) is being actively exploited; patch or block /api/session/reset_password now | ctxsec
url: https://ctxsec.com/items/metabase-cve-2026-72898-csa-singapore-active-exploitation
description: "CVE-2026-72898 is an unauthenticated SQL injection on Metabase's /api/session/reset_password endpoint that can give an attacker administrator access to the instance and, from there, stored credentials for connected databases. Metabase's own advisory (GHSA-vwf4-m7j8-wcjf) rates it Critical and confirms active exploitation. Singapore's Cyber Security Agency issued alert AL-2026-158 on Nov 4 telling operators to patch immediately and, if they cannot, to block that endpoint. Affected OSS/Enterprise lines span 0.58/1.58 through 0.63/1.63; fixed builds are 0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5 (and the matching 1.x Enterprise builds)."
status: "official (Metabase GHSA-vwf4-m7j8-wcjf; Singapore CSA AL-2026-158, Nov 4); Metabase confirms active exploitation; public PoC exists; not in CISA KEV as of catalog 2026.11.04"
published: 2026-11-04
---

> CVE-2026-72898 is an unauthenticated SQL injection on Metabase's /api/session/reset_password endpoint that can give an attacker administrator access to the instance and, from there, stored credentials for connected databases. Metabase's own advisory (GHSA-vwf4-m7j8-wcjf) rates it Critical and confirms active exploitation. Singapore's Cyber Security Agency issued alert AL-2026-158 on Nov 4 telling operators to patch immediately and, if they cannot, to block that endpoint. Affected OSS/Enterprise lines span 0.58/1.58 through 0.63/1.63; fixed builds are 0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5 (and the matching 1.x Enterprise builds).

[← Cybersecurity News](/news) · [markdown](/items/metabase-cve-2026-72898-csa-singapore-active-exploitation.md)

official (Metabase GHSA-vwf4-m7j8-wcjf; Singapore CSA AL-2026-158, Nov 4); Metabase confirms active exploitation; public PoC exists; not in CISA KEV as of catalog 2026.11.04

2026-11-04

### Singapore CSA warns that Metabase CVE-2026-72898 (unauthenticated SQL injection → admin, CVSS 10.0) is being actively exploited; patch or block /api/session/reset_password now

- **Who is exposed:** any self-hosted Metabase whose reset-password API is reachable from untrusted networks — especially internet-facing instances.
- **Immediate actions:** upgrade to the fixed build for your major version; if you cannot upgrade tonight, block `/api/session/reset_password` at the reverse proxy/WAF.
- **After upgrade on a previously public instance (per Metabase):** delete all rows in `core_session`, review/delete unrecognized API keys, review admin accounts, rotate credentials for connected databases, and check Metabase query history plus warehouse logs for unexpected access. GreyNoise had already been seeing elevated Metabase probing before the CSA note (see our earlier hunt).

Sources: [Singapore CSA AL-2026-158: Active Exploitation of Metabase Vulnerability (Nov 4)](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-158/) · [Metabase GHSA-vwf4-m7j8-wcjf: SQL injection using an unauthenticated endpoint leading to admin access](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf)