Metabase has reported a critical SQL Injection vulnerability that may expose sensitive customer data, including credentials and API keys.

Context

The vulnerability, designated CVE-2026-72898, affects versions 1.58 and later of the Metabase platform.S1S2

Key points

• The vulnerability is classified as critical with a severity score of 10.S1S2

• It allows attackers total access to sensitive information.S1S2

• Customers are warned that their credentials and tokens may have been compromised.S1S2

• The issue was disclosed on August 6.S1S2

• Metabase is a business intelligence platform used for data analysis.S1S2

• Experts advise immediate action due to the high severity rating.S1S2

• The vulnerability is a zero-day exploit, meaning it is actively being exploited before a fix is available.S1S2

• Users are encouraged to update to the latest version to mitigate risks.S1S2

Why it matters

• The exposure of sensitive data can lead to significant security breaches.S1S2

• A high severity rating indicates a serious risk for organizations using Metabase.S1S2

• The incident highlights the importance of timely software updates and vulnerability management.S1S2

What to watch

• Monitor for updates from Metabase regarding patches or fixes for the vulnerability.S1S2

• Watch for potential exploits in the wild as attackers may target vulnerable systems.S1S2

• Stay informed about best practices for securing business intelligence platforms.S1S2