A vulnerability in a new package just gave attackers complete access to business intelligence data across thousands of organizations. On August 6, researchers disclosed CVE-2026-72898, a SQL Injection flaw in Metabase's open-source BI platform that earned the rare perfect CVSS score of 10. As David Shipley noted, these perfect scores are exceptionally rare. This one deserved it.
The vulnerability affects Metabase versions 1.58 and up. Approximately 13% of cloud environments run self-hosted Metabase instances, and about 25% of those are fully accessible on the internet. That's thousands of exposed dashboards connected directly to production databases.
What Happened
Attackers exploited an unauthenticated SQL Injection vulnerability in Metabase's query interface. The flaw allowed remote code execution without credentials, giving attackers direct access to any database Metabase connected to. No authentication required. No user interaction needed. Just send a crafted request to an exposed endpoint.
Organizations using Metabase to visualize customer data, financial records, or operational metrics suddenly faced complete data exposure. The vulnerability didn't just leak data; it granted attackers the same privileges Metabase held in the underlying database. If your Metabase service account had write access, so did the attacker.
Timeline
August 6: Public disclosure of CVE-2026-72898. Metabase releases patches for affected versions.
August 6-7: Security teams begin emergency patching cycles. Organizations with internet-facing instances face immediate exploitation risk.
Ongoing: Incident response teams work to determine the scope of exposure. The question isn't whether instances were scanned; it's whether attackers exploited them before patches were deployed.
Which Controls Failed
Input validation at the application layer: Metabase's query parser failed to sanitize user-supplied input before passing it to SQL execution contexts. This is textbook SQL Injection, the same vulnerability class that's topped OWASP lists for two decades.
Network segmentation: Organizations running Metabase with direct internet exposure violated basic defense-in-depth principles. BI platforms should sit behind VPNs or identity-aware proxies, not answer queries from any IP address.
Least privilege for service accounts: Many Metabase deployments use database credentials with excessive permissions. If Metabase needs read-only access to generate reports, its service account shouldn't have INSERT, UPDATE, or DELETE privileges.
Vendor security monitoring: Organizations lacked processes to track security advisories for third-party software. The gap between disclosure and patch deployment creates the exploitation window.
What Standards Require
PCI DSS v4.0.1 Requirement 6.2.2 mandates that security vulnerabilities are identified using industry-recognized sources and new vulnerabilities are assigned a risk ranking. Organizations processing payment data should have been tracking Metabase's security advisories and treating this CVSS 10 as critical.
Requirement 6.4.3 requires that all scripts and custom code are reviewed prior to release to production. While this applies to your code, the principle extends to third-party software. You need a process to evaluate security updates before they reach production, and to deploy critical patches on an accelerated timeline.
OWASP ASVS v4.0.3 Section 5.3 covers output encoding and injection prevention. It requires that all SQL queries use parameterized queries, prepared statements, or stored procedures to prevent injection attacks. Your vendor selection process should verify that third-party tools meet these requirements.
ISO/IEC 27001:2022 Control 8.8 addresses management of technical vulnerabilities. You need documented procedures for obtaining timely information about technical vulnerabilities, evaluating exposure, and taking appropriate measures. "We'll patch it eventually" doesn't meet the standard.
NIST 800-53 Rev 5 SI-2 requires flaw remediation within organization-defined time periods. For a CVSS 10 with public exploit code, your time period should be measured in hours, not weeks.
Lessons and Action Items
Implement automated vulnerability scanning for third-party software. Don't rely on vendor emails or manual checks. Use tools that monitor CVE databases and vendor security advisories, then automatically create tickets for your team. Set up alerts for any vulnerability scoring above CVSS 7.
Establish emergency patch procedures. Your standard change management process takes too long for critical vulnerabilities. Document an accelerated path: who approves, what testing you'll skip, how you'll roll back if needed. Practice it before you need it.
Audit database permissions for all service accounts. Your BI tool doesn't need db_owner. Your monitoring agent doesn't need sysadmin. Start with read-only access and add privileges only when you can document the business requirement. Log every permission grant.
Move administrative tools behind additional authentication layers. If your Metabase instance doesn't need internet access, put it behind a VPN. If it does, add an identity-aware proxy that requires SSO. Every administrative interface should have at least two authentication factors between it and the public internet.
Build a vendor security scorecard. Before you deploy third-party software, evaluate: Does the vendor publish security advisories? Do they participate in bug bounty programs? How fast did they patch their last critical vulnerability? What's their responsible disclosure policy? If you can't answer these questions, you're accepting unknown risk.
Test your incident response for third-party compromises. Your runbooks probably cover scenarios where your code has a vulnerability. Do they cover cases where a vendor's code exposes your data? Who decides whether to take a business-critical tool offline? How do you determine what data an attacker accessed through a compromised BI platform?
SQL Injection isn't new. We've had parameterized queries for decades. But this vulnerability proves that supply chain security requires the same rigor you apply to your own code. When you deploy third-party software with database access, you're trusting that vendor's security practices as much as your own. Make sure that trust is justified.
