{"vulnerability": "CVE-2026-72898", "sightings": [{"uuid": "257a89ad-e4bf-4974-95ce-83a2acfb1030", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72898", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3msuozcdc6y2a", "content": "\ud83d\udea8 CVSS 10.0 doesn't mean 'patch soon.' It means 'drop everything and patch now.'\n\nMetabase.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-72898-metabase-sql-injection-grants-admin-access/\n\nby Yazoul AI #CyberSecurity #Security", "creation_timestamp": "2026-08-12T08:19:21.971084Z"}, {"uuid": "495530da-815d-48c6-a7a8-4f00dd758f5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3msv2jy2crg22", "content": "\ud83d\udea8 CRITICAL THREAT: CISA adds CVE-2026-72898 (Metabase SQL Injection) to the KEV catalog due to active exploitation. Unauthenticated attackers can hijack admin rights and steal database credentials. Full TSUITE brief with SPL, KQL, AQL & YARA-L: https://thecybermind.co/jily\n\n#CyberSecurity", "creation_timestamp": "2026-08-12T11:45:32.323491Z"}, {"uuid": "a5353a00-b574-4bb4-abdf-a68eae39e220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/bishopfox.bsky.social/post/3msv7wrfi4o2f", "content": "\ud83d\udea8 Critical Metabase SQL injection (CVE-2026-72898)\n\nCVSS 10.0.\n\nNo authentication required.\n\nActively exploited in the wild.", "creation_timestamp": "2026-08-12T13:22:10.641022Z"}, {"uuid": "6eefde50-73ee-465c-9347-b43df885f8cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3msva5igoc62f", "content": "Metabase Hit by a Critical Zero-Day: CVE-2026-72898 Puts Business Intelligence Data at\u00a0Risk\n\nIntroduction: When the Analytics Layer Becomes the Attack Path Metabase is often treated as the quiet engine behind dashboards, reports, business intelligence, and data-driven decision-making. It may not be\u2026", "creation_timestamp": "2026-08-12T13:25:55.866984Z"}, {"uuid": "5081d2ba-cc4b-416e-969e-5f8a1f1cba05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3msvpzkymkk22", "content": "CVE-2026-72898 is trending. Hype score 9, currently #4 on cvemon.\n\nMetabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.\n\nhttps://cvemon.intruder.io/cves/CVE-2026-72898", "creation_timestamp": "2026-08-12T18:10:04.506044Z"}, {"uuid": "6d66573b-b58f-4da2-a080-2738588b2be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/117072531713464991", "content": "Since Metabase couldn't be bothered, it looks like CISA has assigned CVEs.\n\nCVE-2026-72898 Metabase SQL injection via password reset endpoint\nCVE-2026-72899 Metabase SQL injection via public card or dashboard\nCVE-2026-72900", "creation_timestamp": "2026-08-10T18:04:27.786996Z"}, {"uuid": "95da889d-b37f-4845-ab2a-ea329ca50f4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3msqorw2bpc22", "content": "Since Metabase couldn't be bothered, it looks like CISA has assigned CVEs.\n\n  * CVE-2026-72898 Metabase SQL injection via password reset endpoint\n  * CVE-2026-72899 Metabase SQL injection via public card or dashboard\n  * CVE-2026-72900\n\n", "creation_timestamp": "2026-08-10T18:04:38.372887Z"}, {"uuid": "2f499ed1-e1c2-4e7b-85ca-f60db5970aeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/h2ggpjbkjd3mt", "content": "CVE-2026-72898 - Metabase SQL injection via password reset endpoint\nCVE ID : CVE-2026-72898\n \n Published : Aug. 10, 2026, 6:18 p.m. | 11\u00a0minutes ago\n \n Description : Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database e...", "creation_timestamp": "2026-08-10T18:56:56.616870Z"}, {"uuid": "767e1052-8fcf-471b-89c1-eacad1aeb62a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msqtdoplmw2o", "content": "CVE-2026-72898\nMetabase's reset password feature can be exploited by an attacker to inject malicious SQL code, potentially gaining administrator access to the connected database. This vulnerability allows an attacker to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-10T19:26:06.295479Z"}, {"uuid": "bb5453e6-ab34-46e6-8b28-f7bb80c997a2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/80ebf1f6-0e2d-47d9-8e7d-dbef120a1e0f", "content": "", "creation_timestamp": "2026-08-10T21:00:26.046615Z"}, {"uuid": "6fe37a59-1c4e-405f-ba60-7c32c3f2ae8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-22", "content": "", "creation_timestamp": "2026-08-11T08:45:05.925004Z"}, {"uuid": "14062b55-004e-4fcb-9eb6-724e9870a7e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-metabase-1", "content": "", "creation_timestamp": "2026-08-11T12:15:03.622545Z"}, {"uuid": "8ca8d508-851d-4698-9d1c-d0d501bd645b", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c4cee6c5-5cc3-4ef7-bfc1-d8f189329f23", "content": "", "creation_timestamp": "2026-08-11T20:00:02.617632Z"}, {"uuid": "e9a53c3e-7d9b-43cf-9b3e-bfa150179b82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mstgkbgaqq2i", "content": "\ud83d\uded1 CVE-2026-72898\nMetabase Metabase\nCVSS 10.0 / EPSS 1% / KEV \u2705\nTL;DR: Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset\u2026\nhttps://cvesentinel.com/report/CVE-2026-72898?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-11T20:15:07.702605Z"}, {"uuid": "7b91ba46-ccaf-488f-a23a-d1a99de73bea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mstgohp7m52v", "content": "~Cisa~\nCISA added three actively exploited vulnerabilities (Cisco ASA/FTD, Windows WinSock, Metabase) to the KEV Catalog.\n-\nIOCs: CVE-2026-20349, CVE-2026-68820, CVE-2026-72898\n-\n#CISA #CVE #ThreatIntel", "creation_timestamp": "2026-08-11T20:17:28.207812Z"}, {"uuid": "a0ac97a3-95fd-4ec5-a531-f0d9d0e90e75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mstmts2uu524", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-72898: Metabase SQL Injection Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-72898", "creation_timestamp": "2026-08-11T22:07:49.530642Z"}, {"uuid": "f88674a0-7a9e-4ed5-a0af-9212a608009d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/406", "content": "proof: python poc-CVE-2026-72898.py --host https://bi.wirx.io", "creation_timestamp": "2026-08-11T23:00:03.518091Z"}, {"uuid": "00c91996-fcb7-4ef5-9090-3603dd9b246c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/405", "content": "Metabase unauthenticated SQL injection -> admin session forgery", "creation_timestamp": "2026-08-11T23:00:03.570762Z"}, {"uuid": "77df193e-eee3-4c32-8733-6a1f94a06a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/406", "content": "proof: python poc-CVE-2026-72898.py --host https://bi.wirx.io", "creation_timestamp": "2026-08-12T00:00:06.759738Z"}, {"uuid": "f3f8fc5b-8316-4210-a531-752748b9be49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/405", "content": "Metabase unauthenticated SQL injection -> admin session forgery", "creation_timestamp": "2026-08-12T00:00:06.840852Z"}, {"uuid": "f7d7a7ed-82ab-4eeb-8666-43e571e9027a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-metabase-1", "content": "Aggiornamenti di sicurezza sanano 2 vulnerabilit\u00e0 con gravit\u00e0 \u201ccritica\u201d in Metabase, piattaforma open source di Business Intelligence (BI). Tra queste si evidenzia la CVE-2026-72898, che risulta sfruttata attivamente in rete.", "creation_timestamp": "2026-08-12T01:00:34.137527Z"}]}