Attackers Actively Exploit Critical Metabase Vulnerability

The Cyber Security Agency of Singapore has issued an alert warning of active exploitation targeting a critical vulnerability in the Metabase business intelligence platform. Tracked as CVE-2026-72898 with a Common Vulnerability Scoring System (CVSS v3.1) score of 10.0 out of 10, the flaw enables unauthenticated remote attackers to execute arbitrary SQL on the application database and gain administrator access. Multiple versions across the 0.x and 1.x branches are vulnerable. Organisations in Singapore, Malaysia, and the wider region operating self-hosted instances should patch immediately or apply network workarounds.

Key Facts

How Does the Vulnerability Affect Metabase Systems?

The vulnerability enables an unauthenticated remote attacker to execute arbitrary SQL commands directly within the Metabase application database. Without supplying login credentials, threat actors can leverage this injection flaw to seize complete administrator access over the target Metabase instance, compromising operational integrity and exposing underlying data.

Because Metabase serves as an analytics layer connected to internal operational databases, administrative compromise provides wide visibility into sensitive assets. The severity is reflected in the maximum possible CVSS rating assigned to this issue.

Exploitation allows unauthenticated remote attackers to execute arbitrary SQL commands and achieve administrator access.

Is This Vulnerability Being Actively Exploited?

Yes, security authorities confirm that attackers are actively exploiting this security flaw in the wild. Furthermore, a proof-of-concept exploit is publicly available on the internet, enabling threat actors to scan for internet-facing instances and conduct automated attacks against unpatched deployments without requiring prior access or authentication.

The existence of public exploit code increases the likelihood of opportunistic attacks against exposed instances. Organisations in Malaysia and across the region that observe suspicious database activity or system anomalies should isolate affected hosts and report incidents to Cyber999.

This vulnerability has been actively exploited, and a proof-of-concept exploit is publicly available.

What Should You Do?

• Update to the latest patched versions released by Metabase immediately.
• If immediate upgrading is not possible, block network access to the /api/session/reset_password endpoint as a temporary workaround.
• Revoke all active user sessions across the Metabase platform.
• Review administrator accounts and existing API keys for unauthorised modifications.
• Rotate credentials for all databases connected to the Metabase instance.
• Inspect server logs thoroughly for signs of unauthorised access or activity.

Common Questions

Which versions of Metabase are affected?

The issue affects Metabase versions 0.58.0 to prior to 0.58.24, 0.59.0 to prior to 0.59.21, 0.60.0 to prior to 0.60.17, 0.61.0 to prior to 0.61.11, 0.62.0 to prior to 0.62.9, 0.63.0 to prior to 0.63.5, and versions 1.58.0 to prior to 1.63.5 across corresponding releases.

What workaround is available if upgrading immediately is not possible?

Administrators unable to apply immediate updates should block access to the /api/session/reset_password endpoint. This temporary mitigation restricts external interaction with the vulnerable component while technical teams plan and execute formal patching routines.

What post-upgrade steps does the vendor guidance recommend?

Administrators hosting accessible instances should follow post-upgrade guidance by revoking active user sessions, reviewing administrator accounts and API keys, rotating credentials for connected databases, and checking logs for signs of unauthorised access or activity.

Sources and Methodology

This dispatch is based entirely on the alert issued by the Cyber Security Agency of Singapore published on 4 November 2026, referencing vulnerability record CVE-2026-72898. ROCKSTARmedia Infosec has not reviewed or verified any additional vendor advisories, third-party code repositories, or external technical write-ups.