---
title: Tip: for self-hosted Metabase, patch CVE-2026-72898 tonight or block /api/session/reset_password, then burn sessions and rotate DB creds if the endpoint was public | ctxsec
url: https://ctxsec.com/items/tip-patch-metabase-72898-block-reset-password-post-upgrade
description: "Unauthenticated SQLi to admin on a BI tool that holds warehouse credentials is a one-shot data-breach path. Metabase and Singapore CSA agree on the order of operations."
status: "official guidance (Metabase GHSA + Singapore CSA AL-2026-158, Nov 4)"
published: 2026-11-04
---

> Unauthenticated SQLi to admin on a BI tool that holds warehouse credentials is a one-shot data-breach path. Metabase and Singapore CSA agree on the order of operations.

[← Tips & Guides](/tips) · [markdown](/items/tip-patch-metabase-72898-block-reset-password-post-upgrade.md)

official guidance (Metabase GHSA + Singapore CSA AL-2026-158, Nov 4)

2026-11-04

### Tip: for self-hosted Metabase, patch CVE-2026-72898 tonight or block /api/session/reset_password, then burn sessions and rotate DB creds if the endpoint was public

- Upgrade to 0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5 (or the matching Enterprise 1.x build). Confirm the version in Admin → Settings → About.
- Until you upgrade: deny `POST /api/session/reset_password` at the reverse proxy. Do not rely on "we only shared the URL internally" if the port is reachable more broadly.
- If the instance was ever internet-reachable on a vulnerable build: wipe `core_session`, audit API keys and admin users, rotate every connected-database password/secret the app stored, and diff recent query history for unknowns.

Sources: [Metabase GHSA-vwf4-m7j8-wcjf](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf) · [Singapore CSA AL-2026-158](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-158/)