A 400 then a 200: Metabase's 10.0, and the patch that was already stale

On August 6, 2026, Metabase published GHSA-vwf4-m7j8-wcjf — "SQL injection using an unauthenticated endpoint leading to admin access." The advisory is rated Critical at CVSS 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and it does not hedge about whether anyone is using it: "Metabase has confirmed active exploitation of this vulnerability."

What earns a 10.0

Ten out of ten is not editorial emphasis, it is what the vector arithmetic returns when every dial is at maximum and the scope bit flips. Network-reachable (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), scope changed (S:C), high impact on confidentiality, integrity and availability. The NVD record for CVE-2026-72898, published 08/10/2026 and last modified 08/12/2026, reaches 10.0 under CVSS v4.0 as well (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and classes the flaw as CWE-89. NVD's description: "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access".

The location is the whole story. /api/session/reset_password is, by definition, an endpoint that must answer before anyone has authenticated. There is no session to check, no permission to consult, no sandbox row-level policy standing between the request and the application database. Every other control Metabase has — and it has many — is downstream of a login that this request never needed.

The tell is a pair of status codes

The most useful thing in Metabase's own write-up is not the patch table. It is the indicator of compromise, which is a sequence rather than a payload:

POST /api/session/reset_password   400
GET  /api/user/current             200

Metabase describes it as a "call to POST /api/session/reset_password with a 400 status code followed by call to GET /api/user/current with a 200 status code." Read that as a log-shape question rather than a signature: a password reset that the application rejected, immediately followed by a request that only an authenticated session can answer successfully. The failure and the success are the point. Anyone with nginx or load balancer logs going back to early August can grep for this without touching the application, and the pattern survives the fact that nobody publishes the request body.

If upgrading is not immediately possible, Metabase's stopgap is to "block the /api/session/reset_password endpoint" at the proxy — which costs you self-service password resets and nothing else. Its post-incident list for anyone who finds the pattern is the conventional one, in the right order: revoke sessions, review API keys, audit accounts, rotate credentials, check logs, review activity history.

Four advisories in six days — and the patch that aged out

This is where a routine "upgrade now" turns into a versioning problem. Metabase published three advisories on August 6: the 10.0 above; GHSA-r8h2-qpfx-mx59 (CVE-2026-72899, Critical, CVSS 9.6, UI:R), "An unauthenticated attacker can inject arbitrary SQL into the Metabase application database using a publicly shared card or dashboard that exposes a field-filter parameter"; and a Moderate one on leaking application-database data to low-privilege users. All three were fixed in the same point releases: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5. (The x is not laziness — NVD lists the affected products as Metabase 0.58.0–0.63.5 and Enterprise 1.58.0–1.63.5, so the open-source build is 0.63.5 and the enterprise build is 1.63.5.)

Then, on August 11, GHSA-r495-55cx-fjh7 — "Multiple vulnerabilities across query validation, permissions, and network exposure," rated Critical, carrying no CVE at all. Its affected ranges run to v58.27, v59.24, v60.20, v61.14, v62.12 and v63.9; its fixed versions are v58.28, v59.25, v60.21, v61.15, v62.13 and v63.10. Line the two up and the arithmetic is unkind: an administrator who did exactly the right thing on August 6 and moved to x.63.5 is sitting inside the affected range of the advisory published five days later. The August 11 release bundles roughly ten categories of hardening, including stricter SQL query input validation, a HoneySQL dependency update addressing CVE-2026-61620, rate-limiting on login and password reset, permission rechecks on entity version reverts, and restrictions on outbound HTTP actions and SSH tunnels.

A critical advisory with no CVE is easy to miss, because most patch-tracking pipelines are keyed on CVE identifiers. This one is keyed on nothing but Metabase's own advisory feed.

The blast radius is the connection strings

CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog on 2026-08-11, with knownRansomwareCampaignUse recorded as "Unknown" and a due date of 2026-08-14 — three days, under BOD 26-04. That deadline has now passed. The catalog entry is unusually explicit about why the tier matters:

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

CISA, Known Exploited Vulnerabilities catalog

That is the part worth internalizing. A BI server is not a reporting tool with a database attached; it is a credential store with a query engine and a public login page. Its value to an attacker is not the dashboards, it is the connection details for every warehouse, replica and production read-only user someone wired into it over the years — plus a native, audited-looking way to export the results. Compromising it is lateral movement that arrives pre-authorized.

What "patched" means this week

Three checks, in order. Confirm you are on x.58.28 / x.59.25 / x.60.21 / x.61.15 / x.62.13 / x.63.10 or later, not merely on the August 6 releases. Grep August access logs for the 400-then-200 pair, and treat a hit as a credential-rotation event for every database Metabase can reach, not just for Metabase. And if your instance is internet-facing because that was easier than a VPN, note that both critical SQLi advisories on August 6 were reachable without credentials — one of them through a publicly shared dashboard link, which is a feature people turn on and never turn off.

Primary sources: Metabase GHSA-vwf4-m7j8-wcjf, Metabase GHSA-r8h2-qpfx-mx59, Metabase GHSA-r495-55cx-fjh7, Metabase security update blog, NVD CVE-2026-72898, CISA Known Exploited Vulnerabilities catalog, read 2026-08-18.