CVE-2026-72900: Metabase information disclosure via native SQL queries

CVE-2026-72900 · Severity: medium · CVSS 6.5 · Published 2026-08-10

Metabase is an open-source analytics and data visualization platform. An authenticated low-privilege user can read the entire application database—including user session records, password hashes, and database credentials stored in plaintext—by creating a SQL query that targets the audit database and enabling public sharing. This exposes sensitive operational data and credentials for connected databases.

Technologies: Metabase. Vendors: Metabase.

Quick answers

Is CVE-2026-72900 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72900 being exploited in the wild.
How severe is CVE-2026-72900?
Medium severity, with a CVSS score of 6.5, published 10 August 2026.
Which products and versions are affected?
Metabase 58.0 to 63.4 (specific ranges: >=58.0 <58.24, >=59.0 <59.21, >=60.0 <60.17, >=61.0 <61.11, >=62.0 <62.9, >=63.0 <63.5).
Is there a fix for CVE-2026-72900?
A patch was published on 2026-08-10: Patches released: v58.24, v59.21, v60.17, v61.11, v62.9, v63.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72900 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-72900?
Check whether you run Metabase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A low-privilege authenticated user can exploit insufficient access controls by creating a native SQL question that targets the audit database, enabling public sharing, and then accessing the data through the public card endpoint. The vulnerability lies in the lack of proper authorization checks on the audit database queries; the system fails to prevent low-privilege users from querying administrative schema. An attacker needs only valid authentication credentials and access to the Metabase interface (network reachable). The impact includes reading the entire application database, extracting user session tokens, bcrypt password hashes, and—on instances without MB_ENCRYPTION_SECRET_KEY set (the default configuration)—database credentials in plaintext. Patches are available in versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5.

Affected products

  • Metabase Metabase 58.0 to 63.4 (specific ranges: >=58.0 <58.24, >=59.0 <59.21, >=60.0 <60.17, >=61.0 <61.11, >=62.0 <62.9, >=63.0 <63.5)

Timeline

  • 2026-08-06: disclosed: GitHub Security Advisory GHSA-8hmm-hrhg-ppqp published
  • 2026-08-10: patched: Patches released: v58.24, v59.21, v60.17, v61.11, v62.9, v63.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.