cveboard RSS feed

CVE-2026-72898

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Metabase SQL injection via password reset endpoint

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Metabase

Vendor
Metabase
Product
Metabase
Platforms
Unknown
Default status
unknown
Metabase · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
x.58.0affectedcustomx.58.24UnavailableNone listed
x.58.24unaffectedUnavailableUnavailableUnavailableNone listed
x.59.0affectedcustomx.59.21UnavailableNone listed
x.59.21unaffectedUnavailableUnavailableUnavailableNone listed
x.60.0affectedcustomx.60.17UnavailableNone listed
x.60.17unaffectedUnavailableUnavailableUnavailableNone listed
x.61.0affectedcustomx.61.11UnavailableNone listed
x.61.11unaffectedUnavailableUnavailableUnavailableNone listed
x.62.0affectedcustomx.62.9UnavailableNone listed
x.62.9unaffectedUnavailableUnavailableUnavailableNone listed
x.63.0affectedcustomx.63.5UnavailableNone listed
x.63.5unaffectedUnavailableUnavailableUnavailableNone listed