CVE-2026-72898: Metabase Bug Nobody Escalated Hit 1M Users

Metabase shipped a fix for CVE-2026-72898 — an unauthenticated, CVSS 10.0 SQL injection in its password-reset flow — on August 6, 2026. CISA added it to the Known Exploited Vulnerabilities catalog five days later, giving federal agencies until August 14 to patch. None of that stopped an attacker from walking into education platform Mathspace’s self-hosted Metabase instance on August 10 and walking out, seventeen days later, with records on 1,079,819 students, parents, teachers, and staff across Australia and New Zealand (Help Net Security; SecurityWeek). Mathspace didn’t apply the patch until August 29 — 23 days after it shipped. The interesting failure here isn’t the SQL injection itself. It’s everything that happened, and didn’t happen, around it.

Root cause

Metabase is a self-hosted BI tool teams point at a data warehouse or production read replica so anyone can build dashboards without writing SQL — which means the Metabase server itself typically holds broad, persistent query access to whatever it’s connected to. The vulnerable code path is its password-reset handler, reachable at the unauthenticated POST /api/session/reset_password endpoint. The request body is supposed to carry a reset token and a new password; the handler didn’t restrict which fields it would accept. Send an extra user-id field built as a HoneySQL query object instead of a plain integer, and Metabase’s query builder treats it as structured SQL rather than a value to bind — the object gets compiled straight into the lookup query it runs against its own application database (Bishop Fox; Offensive Security). From there an attacker can rewrite arbitrary rows in the core_user table — including flipping is_superuser to true on an account they control — with no credentials and no prior access. It’s not injection into the warehouse Metabase queries on your behalf; it’s injection into Metabase’s own auth store, which is worse in one specific way: it doesn’t require guessing anything about your schema, just reaching the endpoint. Affected versions ran from 0.58/1.58 through 0.63.4/1.63.4, which is to say: most self-hosted installs that hadn’t updated recently.

Blast radius

Full admin takeover of a BI tool is already bad — a Metabase admin can run arbitrary SQL against every data source it’s configured with, export results, and read saved questions and dashboards built by everyone else in the org. In Mathspace’s case, the exposed instance sat on their Australian reporting database, and the extortion group ShinyHunters claimed responsibility for pulling names, user IDs, usernames, email addresses, verification status, time zone, country, and account timestamps for over a million people — a meaningful share of them students. No passwords or payment data were in the export, which caps the damage but doesn’t erase it: that data set is a ready-made input for targeted phishing against a population that includes minors. The part that should worry any team running Metabase internally, though, is the timeline. CISA’s KEV listing went out August 11 — one day after Mathspace was already compromised. By the time the org-level response would normally kick in (“we’re on the exploited list, go check our instance”), the exploitation had already happened. Reactive patching on a CVSS 10.0, KEV-listed, actively-exploited bug is a race you can lose even when you eventually win it.

Remediation

Patch first, obviously — Metabase’s fix rejects unexpected fields in the reset-password body instead of trusting the query builder to interpret whatever it’s handed. But the more durable lesson is in what Mathspace said about its own process: “our existing vulnerability-notification process did not identify and escalate that advisory for action.” A maximum-severity advisory for a product they ran existed for three weeks without reaching anyone who could act on it. If you self-host BI or admin tooling, that’s the gap to close first — subscribe to the vendor’s security advisories and the CISA KEV JSON feed directly, route both to an owner with authority to patch on a deadline, not a shared inbox nobody’s accountable for. Second, an internal BI tool with query access to production data doesn’t belong on the open internet at all — put it behind SSO or a VPN, not just a login screen, so an unauthenticated endpoint like this one is unreachable regardless of what’s wrong with it. Third, treat “patched” and “checked for prior compromise” as two separate, both-mandatory steps: Mathspace patched on August 29 but skipped the compromise assessment Metabase recommended for instances that had stayed exposed, and didn’t find the intrusion in its own logs until September 3. For any KEV-listed, actively-exploited CVE, assume compromise happened before you patched and go look, rather than treating the patch itself as the finish line.