CVE-2026-72898 is an unauthenticated SQL injection in Metabase, the open-source business intelligence platform. It is reachable through the password reset endpoint, yields administrator access, carries a CVSS score of 10.0 and affects versions 0.58 through 0.63.4 and the equivalent Enterprise builds. CISA added it to the Known Exploited Vulnerabilities catalog on 11 August 2026.
Metabase disclosed the flaw on 6 August. Exploitation predates both that disclosure and the assignment of the CVE, and five companies had already lost customer data by the time it was published. Framework, Anaconda and the workflow automation platform n8n — all Metabase Cloud tenants — have since disclosed unauthorised access to customer data from the pre-patch period. n8n reported 136 records containing names and email addresses, five of them including bcrypt-hashed passwords.
The Analytics Layer Holds The Credentials
A business intelligence deployment exists to query other systems, so it stores the connection strings and credentials for each of them: data warehouses, production replicas, transactional databases.
Administrator access to the console therefore reaches well past the console. That is the same shape as the CircleCI intrusion in 2023, after which the company told every customer to rotate every secret it had ever held. A tool bought for reading data ends up holding the keys to it, and it gets inventoried as reporting software.
Exploited Before It Had A Number
Exploitation came before disclosure and before the CVE existed. Five organisations lost customer data while there was nothing to patch and no identifier to track.
That is the structural weakness of a defence organised around published identifiers. A vulnerability catalogue records what defenders have learned, and it starts after the attackers have already finished.
The Reset Endpoint, Again
The injection point is the password reset path — the one route an application has to expose to people who cannot authenticate.
Account recovery keeps turning up as the soft edge in these files: self-service password tools, help-desk resets, security answers stored next to their questions. Everything else in an application can demand credentials first. Recovery cannot, by definition.
Record Counts Are The Wrong Measure Here
One disclosed victim reported 136 records. Against the populations this database usually counts that is nothing, and it is not the exposure that matters.
What an attacker takes from a Metabase instance is primarily the means to reach the systems it queries. No disclosure published so far says whether those downstream credentials were used, or rotated. Until one does, the size of this incident is unknown rather than small.
Compiled from Metabase’s advisory, CISA’s KEV listing, the affected companies’ disclosures and public analysis, listed below. Framework, Anaconda and n8n are named because each disclosed publicly. No evidence has been published that downstream credentials were used, and we are not asserting it. Corrections: corrections@forensicpost.com.