Metabase CVE-2026-72898: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since at least 2 August, with VenariX counting fifteen downstream victims

The entry on Metabase's unauthenticated SQL-injection zero-day closed on the observation that no CVE identifier had been assigned, so a purely CVE-driven patch process would not surface the exposure at all. That gap is now closed in both directions. GitHub Security Advisory GHSA-vwf4-m7j8-wcjf assigns CVE-2026-72898 with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and Metabase's own advisory text states that "Metabase has confirmed active exploitation of this vulnerability" and that the flaw "allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance" (Metabase, 2026-08-06). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-08-11 (CISA, 2026-08-11).

The second half of the delta is the affected-version matrix, which the vendor's original blog post did not carry in this form. The advisory lists the affected ranges per release line as >= x.58.0 < x.58.23, >= x.59.0 < x.59.20, >= x.60.0 < x.60.16, >= x.61.0 < x.61.10, >= x.62.0 < x.62.8 and >= x.63.0 < x.63.3, and names the patched versions separately as x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5; note the two lists do not meet, so a build sitting between an affected upper bound and its patched release is not described either way and should be treated as needing the named patched version (Metabase, 2026-08-06). That turns "upgrade Metabase" into a query an asset inventory can answer, and it is what a scanner needed in order to report anything at all.

Nothing here changes the exposure of an instance that has not been upgraded; the exploitation window has been open since at least 3 August per the earlier coverage, and the interim control is unchanged: block the /api/session/reset_password endpoint if an upgrade cannot happen immediately. What changed is visibility, and that is the operationally useful part. An organisation whose vulnerability management runs off CVE identifiers, SBOM matching or KEV feeds got no signal on this flaw for over a week while it was being exploited; the same tooling will now produce a finding on the next scan cycle. The advisory's post-upgrade guidance also stands and is worth re-reading against what an attacker with administrator access would already have taken: revoke active sessions, audit API keys and administrator accounts, and rotate the stored credentials for every connected data source, because those credentials are what an instance-level compromise reaches.

The count of downstream victims is now the story. VenariX's tracker, first published 2026-08-10, lists n8n, Framework, Tally and Kilo Code from the first wave, followed by Stocksy United Co-op, ShipMonk, Checkly, Cypress.io and Bits of Gold (VenariX, 2026-08-10). The earlier entries covered the flaw itself: an unauthenticated SQL injection reachable at the password-reset endpoint, CVSS 10.0, exploited, catalogued as such on 2026-08-11.

The mechanism behind the growing list is a property of business-intelligence tooling rather than of this bug. Metabase stores the connection configuration, including credentials, for every external database and warehouse it queries; an attacker who reaches administrative context in the application can therefore read those stored credentials and query or export whatever they reach (VenariX, 2026-08-10). The blast radius of any given instance is set entirely by what it was wired to; VenariX's own framing is that a deployment connected only to a restricted reporting database is a materially different incident from one connected to a production warehouse, which is the assessment question a defender should be answering first.

The victim disclosures show the range. n8n's update of 11 August breaks its 136 accessed records down: 7 with cloud usernames and email addresses and 5 that also held bcrypt-hashed n8n Cloud passwords were confirmed accessed, 62 with names and email addresses may have been, and the remaining 62 held nothing sensitive (n8n, 2026-08-08). Framework confirmed customer data was stolen including names, email addresses, phone numbers, login IP addresses and billing and shipping addresses, and Tally's exposure covered email addresses and password hashes while form content was stored separately and unaffected (BleepingComputer, 2026-08-07). Kilo Code says a subset of its users or organizations may have had partial or full prompts or user data such as name, email address, billing address and location exposed (Anaconda, 2026-08-07). Of the newly added names, Bits of Gold separately disclosed on 2026-08-16 that an attacker gained unauthorized access to a third-party data analytics network and obtained names, national ID numbers and emails for roughly 200,000 customers (DataBreaches.net, 2026-08-17); the company describes the platform class, not the product, and it is VenariX that places the incident in this campaign.

The operational point is the one most likely to be got wrong in a remediation ticket. Metabase's own guidance, as VenariX relays it, is that "Credential rotation is especially important if exploitation is suspected, because patching the application does not invalidate credentials that may already have been exposed" (VenariX, 2026-08-10). An estate that upgraded Metabase and closed the ticket has fixed the injection and left the attacker holding working warehouse credentials. Metabase's fuller recommendation set for potentially exposed instances is to revoke active sessions, review administrator accounts and API keys, rotate credentials for connected databases, and review both Metabase and warehouse logs; where an immediate upgrade is impossible it recommends temporarily blocking access to the reset-password endpoint.

Detection has an unusually crisp anchor for a SQL-injection flaw, because the vendor published one. Metabase identified a recurring two-request pattern associated with exploitation (a POST to /api/session/reset_password returning HTTP 400, immediately followed by a GET to /api/user/current returning HTTP 200) and "Metabase states that this pattern in application or ingress logs indicates that the instance was likely compromised" (VenariX, 2026-08-10). Beyond that, the investigative surface is Metabase's own query history, database and warehouse audit logs, administrator accounts, API keys, and any unexpected use of the stored connection credentials; the last being where a compromise that started in the BI tier becomes visible in the warehouse tier.

Triage: a failed password reset followed by a session check is not by itself unusual in a web application's logs, which is exactly why the ordered pair matters rather than either request alone; a genuine failed reset does not produce an authenticated /api/user/current success on the same session immediately afterwards. Downstream, the discriminator for warehouse activity is whether queries arriving under the Metabase service credential match the dashboards and questions that credential is actually used for: bulk selects against tables no saved question references, or access at hours the reporting schedule does not run, are the signal, while high query volume under that identity is normal by design.

The downstream count grows again, through a further intermediary. Shipup, a French platform used by more than 700 e-commerce brands to send delivery-tracking notifications and post-purchase communications, ran a Metabase instance whose compromise Cyberattaque.org links to the campaign against Metabase, with unauthorized access possible between 31 July and 17 August 2026, a window that starts earlier than the "since at least 3 August" the earlier coverage had established for the campaign (Cyberattaque.org, 2026-09-26). Carrefour notified some customers in early September, after Cyberattaque.org had already reported Micromania and Easypara exposed through the same Shipup compromise (Cyberattaque.org, 2026-09-26), and French Breaches notes similar incidents at Printemps, Citadium and Aroma-Zone (French Breaches, 2026-09-27). The exposed categories match the pattern this campaign has shown throughout: names, email addresses and phone numbers; Carrefour states no banking data or passwords were affected, and Cyberattaque.org reads nothing in its communication as suggesting that its site, customer accounts or internal systems were compromised, consistent with the exposure being limited to data it had shared with Shipup for delivery notifications. Carrefour has not disclosed the exact number of customers affected or confirmed whether the exposure window matches Shipup's own 31 July-17 August dates.

Shipup is a new entry in this campaign's chain of intermediary vendors, distinct from the data warehouses and analytics platforms this entry's earlier coverage described (n8n, Kilo Code and the others connected directly to a compromised Metabase instance): here, the retail brands are themselves downstream of a vendor that was downstream of the Metabase flaw, a second hop the credential-rotation and log-review guidance in this entry's original analysis already covers, since it applies to any instance that was reachable and unpatched during the exploitation window regardless of how many contractual layers separate the ultimate data subject from the compromised application.

VenariX's tracker has grown from nine confirmed downstream incidents to fifteen. The additions to the nine named in the update of 2026-08-19 are Privy, Paradigm Connect Asia, Statista, Dodo Payments, Marsello and LEGO Certified Stores South Africa (VenariX, 2026-08-10, revised since). The Shipup compromise and its retail clients, covered in the update of 2026-09-27, are not on that list, so the real total is higher still.

The larger change is who is using the flaw. VenariX says it has confirmed that Dire Wolf, a ransomware and data-extortion group, exploited CVE-2026-72898 in at least two incidents against self-hosted Metabase deployments, at Statista and Dodo Payments, and suspects the group targeted fourteen more companies the same way. It is explicit that it has no evidence Dire Wolf discovered the zero-day or is behind the other confirmed incidents (VenariX, 2026-08-10, revised since). Dodo Payments, a payments company, confirms the vector without naming an actor: an unauthorised party exploited CVE-2026-72898 in a self-hosted Metabase instance used for internal reporting, viewed and queried the reporting datasets that system could reach, and the company contained it within hours of learning of it on 16 August (Dodo Payments, 2026-08-17). A dark-web listing dated 16 August, reviewed but not verified by MediaNama, claims about 60.8 GB and 39.3 million rows from four ClickHouse analytics databases, including tables it labels API keys, one-time passcodes and identity-provider credentials, where Dodo says API keys and credentials were not in the affected system (MediaNama, 2026-09-01).

For a defender this moves the self-hosted exposure from opportunistic data theft to an extortion operator's target list. The dispute over what left Dodo's warehouses is the point this entry has made since August: the reach of a compromised Metabase instance is whatever its stored connections reach, and the vendor's statement of what the BI tool itself held does not bound it. An instance that was internet-reachable on a vulnerable build between late July and its upgrade should be scoped as a warehouse compromise, not an application one.

Republik, a Swiss online magazine, reported that an unauthorised access that had been going on since August ended on Wednesday 2026-10-14, when one of its analysis tools stopped working and it took its own Metabase installation offline; its statement says the vulnerability had been known since 6 August and that the magazine failed to take countermeasures in good time (swissinfo.ch, 2026-10-16). Netzwoche quotes it saying it had not subscribed to the manufacturer's security warnings and had no automatic check that reports a known gap in the software it runs (translated from German; Netzwoche, 2026-10-19).

The attackers certainly retrieved the records of all registered users, at least names and email addresses and in part date of birth and gender, and demonstrably sampled postal addresses, comments and votes; Republik reported the incident to the Federal Data Protection and Information Commissioner on 2026-10-15 (Netzwoche, 2026-10-19; swissinfo.ch, 2026-10-16). Republik believes it was a broad automated wave in which the attackers first looked for what every Metabase installation holds, such as login details and keys for AI services that could be resold, and says nothing indicates anyone targeted the magazine specifically (swissinfo.ch, 2026-10-16). It will use Metabase again only when it is updated and no longer reachable from the open internet, and says the stolen data had not surfaced online (Netzwoche, 2026-10-19).