Analytics Under Siege: Business Intelligence Portals Exploited

The Cybersecurity and Infrastructure Security Agency (CISA) has designated CVE-2026-72898 as an actively exploited threat in enterprise networks. The vulnerability affects Metabase, the ubiquitous open-source and enterprise business intelligence (BI) platform deployed across tech startups, fintech institutions, and corporate enterprises to build dashboards and query internal databases.

Carrying a CVSS 9.8 Critical score, the flaw allows attackers to perform unauthenticated or authenticated SQL injection against backend data warehouses (such as PostgreSQL, MySQL, Snowflake, BigQuery, and Redshift), leading to the catastrophic exfiltration of millions of corporate records.

Vulnerability Mechanics: Parameterized Query Bypass

Metabase allows users to create interactive dashboard cards where query filters are passed as dynamic parameters. In vulnerable versions, when processing specialized date and categorical filter widgets in the card execution API (/api/card/:id/query), the query generation engine fails to strictly parameterize subquery variables before passing them to the target database driver.

By crafting malicious JSON requests containing injected SQL syntax (such as UNION SELECT constructs or stacked queries), attackers bypass application-level permissions and execute raw queries against the underlying database under the context of the configured Metabase database user account.

Metric Details
CVE Identifier CVE-2026-72898
CVSS v3.1 Score 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE Classification CWE-89: SQL Injection
Affected Versions Metabase Open Source and Enterprise versions prior to 0.50.14 and 1.50.14
Fixed Versions Metabase v0.50.14 / v1.50.14 and newer
Exploit Status Active in-the-wild exploitation confirmed by CISA

Blast Radius: High-Volume Data Exfiltration

Because Metabase service accounts are frequently granted broad read access across enterprise data warehouses, a single SQL injection flaw allows attackers to dump:

  • Customer Personal Information: Names, hashed passwords, email addresses, and phone records.
  • Financial Telemetry: Transaction ledgers, payment amounts, and banking metadata.
  • Corporate Strategy Data: Internal revenue forecasts, pipeline analytics, and executive dashboards.

Defensive Engineering & Remediation Checklist

DevOps and security teams must implement immediate defensive actions:

1. Upgrade Metabase Instantly

Update Metabase containers or JAR installations to v0.50.14 (Open Source) or v1.50.14 (Enterprise): 

# For Docker deployments, pull and restart with the latest verified release
docker pull metabase/metabase:v0.50.14
docker stop metabase-prod && docker rm metabase-prod
docker run -d -p 3000:3000 --name metabase-prod metabase/metabase:v0.50.14

2. Restrict Database Service Account Privileges

Enforce least-privilege principles at the database level. Never configure Metabase using superuser (e.g., postgres or root) database credentials. Ensure the service user only possesses SELECT permissions on approved analytical views rather than raw transactional tables.

3. Isolate BI Portals from Public Ingress

Never expose business intelligence dashboards to the public internet. Enforce authentication through an enterprise identity provider (SSO) protected by multi-factor authentication (MFA) and access control lists (ACLs).