CVE-2026-72898

CRITICAL10.0Published on August 10, 2026

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVSS score10.0 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-89

CISA aggiunge tre vulnerabilità sfruttate al catalogo KEV

Vulnerabilities

CISA Adds Three Exploited Vulnerabilities to the KEV Catalog

CISA adds three exploited vulnerabilities to KEV catalog: CVEs in Cisco ASA/FTD, Windows, and Metabase. Organizations must prioritize remediation.

Aug 12, 20262 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

CISA Adds Three Exploited Vulnerabilities to the KEV Catalog