Detecting Metabase CVE-2026-72898 Exploitation: SQL Injection Against BI Analytics Infrastructure

CVE-2026-72898 is a CVSS 10 unauthenticated SQL injection in the Metabase password reset endpoint (POST /api/session/reset_password). An attacker with network access to Metabase can inject arbitrary SQL into the application database without credentials, obtain admin access, and extract stored database connection strings for every data source the instance is connected to — including Databricks, Snowflake, Redshift, BigQuery, MongoDB, and Oracle. CISA added it to the Known Exploited Vulnerabilities catalog on August 11, 2026. At least five organisations lost customer data before the patch was available.

This guide covers detection across three stages: exploitation of the vulnerable endpoint, post-authentication admin activity (the attacker’s actions after achieving admin access), and downstream credential abuse in connected database systems.

MITRE ATT&CK Mapping

Detection Surface 1: Exploitation of the Password Reset Endpoint

The injection occurs at POST /api/session/reset_password. Under normal operation, this endpoint accepts a JSON body with a reset token and new password. The vulnerability arises because Metabase does not reject undeclared JSON fields — extra keys flow into a database lookup query without parameterisation.

Exploitation payloads are distinguishable from legitimate password resets in two ways:

1. Request size: Legitimate resets contain two fields (token, password). Exploitation payloads contain additional injected fields, making the JSON body substantially larger.
2. Timing pattern: The endpoint is not normally accessed repeatedly. Multiple requests in a short window — particularly from a single source IP — are anomalous.

Log sources: web server access logs for the Metabase port (default 3000), application logs at Metabase startup path.

Sigma Rule — Anomalous POST to Metabase Password Reset Endpoint

title: Metabase CVE-2026-72898 — Password Reset Endpoint Exploitation Attempt
id: 3a8f2c71-9e4b-4d2a-b6f1-7c0d5e3a1982
status: experimental
description: Detects unusual POST requests to the Metabase password reset endpoint that may indicate CVE-2026-72898 SQL injection exploitation. Triggers on high request body size or repeated access from a single source IP within a short window.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72898
  - https://bishopfox.com/blog/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898
author: SOC Analyst Hub
date: 2026-08-15
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-72898
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: '/api/session/reset_password'
  filter_normal_size:
    sc-bytes|lt: 500
  condition: selection and not filter_normal_size
  timeframe: 5m
  groupby:
    - c-ip
  condition_grouped: count() > 2
falsepositives:
  - Legitimate concurrent password reset operations (extremely uncommon)
level: high

KQL — Microsoft Sentinel / Defender for Endpoint

// Metabase CVE-2026-72898 — Exploitation attempt detection
// Requires web application logs ingested (e.g., via Syslog or custom table)
// Adjust table name to match your log source ingestion
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod == "POST"
| where RequestURL contains "/api/session/reset_password"
| where RequestBodyBytes > 500  // legitimate resets are small
| summarize
    AttemptCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    ByteSizes = make_set(RequestBodyBytes)
    by SourceIP, DeviceVendor
| where AttemptCount > 1
| extend AlertSeverity = case(
    AttemptCount > 5, "High",
    AttemptCount > 2, "Medium",
    "Low"
)
| sort by AttemptCount desc

Detection Surface 2: Post-Compromise Admin Activity

After achieving SQL injection, an attacker gains admin-level access to Metabase. Admin actions are logged in the Metabase audit log. If audit logging is enabled, the following activity patterns are suspicious when they occur outside business hours, from an IP not in the normal admin range, or immediately following a password reset endpoint request.

Key post-exploitation actions to hunt:

• Credential extraction: An admin browsing to the database connections page (/admin/databases) to view stored connection strings
• Privilege escalation: Creating a new admin account or modifying user roles
• Data exfiltration: Running bulk queries or exporting large result sets through the query runner
• Configuration changes: Modifying or adding database connections

Sigma Rule — Metabase Admin Account Creation After Anomalous Authentication

title: Metabase Admin User Created Outside Change Window
id: 8b2d4f91-3c7e-4a5b-9d2f-1e6a8b4c3d71
status: experimental
description: Detects Metabase admin account creation events from source IPs not present in the baseline admin access list, or occurring outside maintenance windows. Correlate with preceding password reset endpoint activity for high-confidence detections.
author: SOC Analyst Hub
date: 2026-08-15
tags:
  - attack.persistence
  - attack.t1078
  - attack.t1136
logsource:
  service: metabase-audit
  category: application
detection:
  selection_admin_create:
    event_type: 'user-update'
    is_superuser: true
    action: 'create'
  filter_known_admin_ips:
    source_ip|cidr:
      - '10.0.0.0/8'       # Replace with your admin management CIDR
      - '192.168.1.0/24'   # Replace with known admin workstation range
  condition: selection_admin_create and not filter_known_admin_ips
falsepositives:
  - Legitimate admin provisioning from cloud or remote IP ranges
level: critical

KQL — Database Connection Export Following Anomalous Login

// Detect Metabase admin browsing the database connections page from unexpected IPs
// This indicates an attacker harvesting stored database credentials
// Replace the CIDR list with your known admin IP ranges
let KnownAdminCIDRs = dynamic(["10.0.0.0/8", "192.168.0.0/16"]);
MetabaseAuditLogs  // Adjust to your actual log table name
| where TimeGenerated > ago(1h)
| where EventType in ("database-list", "database-details")
| extend IsKnownAdmin = ipv4_is_in_range(SourceIP, KnownAdminCIDRs[0])
    or ipv4_is_in_range(SourceIP, KnownAdminCIDRs[1])
| where not IsKnownAdmin
| project TimeGenerated, SourceIP, UserEmail, EventType, DatabaseName
| join kind=leftouter (
    // Look for preceding password reset activity within the last hour
    CommonSecurityLog
    | where TimeGenerated > ago(1h)
    | where RequestURL contains "/api/session/reset_password"
    | summarize PasswordResetCount = count() by SourceIP
) on $left.SourceIP == $right.SourceIP
| extend Suspicious = iff(isnotempty(PasswordResetCount), "HIGH - preceded by reset endpoint activity", "MEDIUM - unexpected IP")
| sort by TimeGenerated desc

Detection Surface 3: Downstream Credential Abuse

Metabase stores connection strings for every connected database, including credentials in plaintext or encrypted form accessible to an admin. Once an attacker extracts these credentials, they authenticate directly to downstream systems — bypassing Metabase entirely.

Detection must occur at the downstream database layer. Look for:

• New source IPs connecting to database servers that Metabase is known to query
• Authentication to database systems from IPs that are not the Metabase server itself
• Bulk query execution or SELECT * style access patterns on tables not previously queried via Metabase
• Connections to warehouse endpoints (Snowflake, BigQuery, Redshift) from external or unexpected IPs

This detection requires baseline knowledge of which IP addresses Metabase uses to connect to each downstream system. That information is in your VPC flow logs, database audit trails, or cloud provider access logs.

Splunk SPL — Database Connections From Non-Metabase Sources

index=db_audit sourcetype=mysql_audit
| eval MetabaseIP="10.1.2.50"  | replace with actual Metabase server IP
| where src_ip != MetabaseIP
| stats count by src_ip, user, db_name, earliest(_time) as FirstSeen, latest(_time) as LastSeen
| where count > 10
| eval SuspiciousReason="Database access from non-Metabase IP after CVE-2026-72898 disclosure window"
| table src_ip, user, db_name, count, FirstSeen, LastSeen, SuspiciousReason
| sort -count

Threat Hunting Checklist

If Metabase was running a vulnerable version (< 0.58.24, < 0.59.21, < 0.60.17, < 0.61.11, < 0.62.9, or < 0.63.5) with internet exposure at any point since August 6, 2026, treat the instance as potentially compromised and work through the following:

1. Pull all POST /api/session/reset_password requests from your web server logs since August 6. Any request with a body > 500 bytes or from an unexpected source IP is a candidate exploitation attempt.

2. Review Metabase audit logs for admin account creation, user role changes, and database connection access events in the exploitation window. Correlate source IPs against your known admin workstation ranges.

3. Inventory connected databases. Every database connection stored in the compromised Metabase instance must be treated as credential-compromised. Pull the connection list from Metabase admin (/admin/databases) or the application database, and initiate credential rotation for all of them.

4. Review downstream database access logs for connections from IPs other than the Metabase server in the post-exploitation window.

5. Check for new or modified admin accounts in Metabase that were not created by your team.

6. Examine large data exports in the Metabase query runner log for bulk result sets that were downloaded by the attacker.

IOC Reference

Known threat actor indicators for CVE-2026-72898 exploitation campaigns have not been specifically published at this time. Monitor:

• Requests to /api/session/reset_password with oversized JSON bodies
• Admin activity in Metabase from IPs outside known management ranges
• New database connections added to Metabase post-exploitation
• Unusual query patterns against downstream databases

References

• NVD — CVE-2026-72898
• Bishop Fox Technical Analysis
• RunZero — Affected Asset Discovery
• CISA KEV Catalog