CVE-2026-72898 is a CVSS 10.0 unauthenticated SQL injection in Metabase, exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalogue on 11 August 2026. Metabase fixed it in 0.63.5.
This is an independent reconstruction. The vulnerability was disclosed by Metabase and CISA; this work records our own root-cause analysis, lab reproduction and review of the fix. It is not the original discovery report.
What we did
- Rebuilt the vulnerable path from the published advisory.
- Reproduced the injection across eight lab rounds in an instance we own.
- Turned the primitive into a single-write administrator takeover.
- Extracted the 0.63.5 change and compared the patched path with the vulnerable one.
Evidence
What it does not prove
All testing happened against lab instances we own. The reconstruction shows the route exists and how the fix closes it; it does not assess any other deployment, and it draws on no client data.