Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)

1. Apply Official Security Patches

Immediately upgrade your Metabase instance to the latest patched version recommended by the vendor.

Docker Upgrade Example:

# Pull the latest secure image
docker pull metabase/metabase:latest

# Stop and recreate the container
docker stop metabase-container
docker rm metabase-container
docker run -d -p 3000:3000 --name metabase metabase/metabase:latest

2. Temporary Mitigation via WAF / Reverse Proxy

If patching cannot be applied immediately, block or restrict access to the vulnerable endpoint using Nginx or a Web Application Firewall (WAF).

Nginx Configuration Example:

# Block external access to the password reset API
location ~* /api/user/reset_password {
    deny all;
    return 403;
}

WAF Rule Recommendation:

• Inspect incoming POST requests to /api/user/reset_password and block payloads containing SQL injection patterns (e.g., UNION, SELECT, comments --, or boolean-based logic).

CVE-2026-72898 is a critical SQL Injection (CWE-89) vulnerability located in the /reset_password database endpoint of Metabase, a popular open-source business intelligence platform.

The root cause lies in the insufficient sanitization and lack of parameterization of user-supplied input within the password reset workflow. An unauthenticated remote attacker can craft malicious payloads containing SQL commands and send them to the vulnerable endpoint.

This vulnerability poses an extreme risk due to the following factors:

• No Authentication Required: Attackers do not need valid credentials or prior access to exploit this flaw.
• Administrative Takeover: Successful exploitation allows attackers to read, modify, or delete database contents, leading to full administrative compromise of the Metabase application.
• Active Exploitation: This vulnerability is listed in the CISA KEV catalog with an EPSS score of 0.94, indicating high-frequency active exploitation in the wild.