CVE-2026-72899: Metabase SQL injection in publicly shared dashboards

CVE-2026-72899 · Severity: critical · CVSS 10 · Published 2026-08-10

Metabase is a self-service analytics platform that allows organizations to query and visualize data from connected databases. An unauthenticated attacker can exploit publicly shared dashboards or cards to inject arbitrary SQL queries, potentially gaining full administrative access, stealing database credentials, and reading or exporting all data accessible through the system. Public sharing is enabled by default, making this a critical risk for any organization that has shared a dashboard or card link externally.

Technologies: Metabase. Vendors: Metabase.

Quick answers

Is CVE-2026-72899 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72899 being exploited in the wild.
How severe is CVE-2026-72899?
Critical severity, with a CVSS score of 10, published 10 August 2026.
Which products and versions are affected?
Metabase >=58.0 <58.24; >=59.0 <59.21; >=60.0 <60.17; >=61.0 <61.11; >=62.0 <62.9; >=63.0 <63.5.
Is there a fix for CVE-2026-72899?
A patch was published on 2026-08-10: Patches released for versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72899 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-72899?
Check whether you run Metabase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a SQL injection vulnerability in Metabase's field-filter (dimension) parameter handling for publicly shared dashboards and cards. The vulnerable component fails to properly sanitize or parameterize user input when processing field-filter parameters in shared links. An unauthenticated attacker can craft a malicious URL using only the public link UUID—which is part of the shared URL by design—to inject arbitrary SQL into the Metabase application database. No authentication is required, user interaction is limited to clicking a link, and network access is sufficient to exploit this vulnerability. A successful attack allows an attacker to modify application configuration, exfiltrate database credentials, read any data accessible through connected databases, and potentially escalate to administrative privileges. Fixes are available in versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5 for their respective major version branches.

Affected products

  • Metabase Metabase >=58.0 <58.24; >=59.0 <59.21; >=60.0 <60.17; >=61.0 <61.11; >=62.0 <62.9; >=63.0 <63.5

Timeline

  • 2026-08-10: disclosed
  • 2026-08-10: patched: Patches released for versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.