External risk intelligence

Metabase Unauthenticated SQL Injection via Shared Cards

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-72899

Metabase is designed to share cards and dashboards publicly. The vulnerability exists within these publicly shared components, which are intended to be accessible over the internet by design.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Metabase, a business intelligence tool, has a critical vulnerability that allows unauthenticated attackers to inject arbitrary SQL commands through publicly shared content. This issue arises from how parameters are handled in shared cards and dashboards, potentially exposing sensitive data or allowing unauthorized modifications.

Unauthenticated SQL injection via public Metabase shares.
Matters due to potential data exposure and unauthorized actions.
Confirm relevance and exposure of public Metabase shares.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by injecting arbitrary SQL through a publicly shared card or dashboard. This occurs when a field-filter (dimension) parameter is exposed, allowing the attacker to manipulate the database queries. When successful, this could lead to significant compromise of the system's data.

No authentication required.
Inject SQL via shared card/dashboard filter.
Potential for complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could exploit this vulnerability by injecting malicious SQL queries through publicly shared Metabase cards or dashboards. This could affect the integrity and availability of the Metabase service and potentially expose or manipulate the data it accesses.

Data accessed by Metabase.
SQL injection via shared cards.
Data corruption or exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Metabase, which allows unauthenticated SQL injection through publicly shared cards or dashboards, impacts organizations that use Metabase for data visualization and sharing. The primary responsibility for addressing this lies with the teams managing the Metabase application and the data it exposes. The first step is to identify all instances of Metabase, confirm if any publicly shared cards or dashboards with field-filter parameters are exposed externally, and then determine the business criticality of these assets to prioritize remediation efforts with the accountable owner.

Application owners and platform teams are responsible.
Verify public sharing and field-filter exposure.
Plan for risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Metabase?

Metabase is an open-source business intelligence and data visualization software. It connects directly to your databases, allowing users to create charts, dashboards, and reports to explore data without needing to write complex code. Its core functionality revolves around simplifying data access and sharing insights across an organization.

How does the CVE-2026-72899 vulnerability work?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). In simple terms, the application fails to properly sanitize user input. Because of this, an attacker can input malicious SQL code into specific dashboard filters, tricking the database into executing unauthorized commands.

Do I need to be logged in for my Metabase instance to be vulnerable?

No. The vulnerability specifically targets publicly shared cards or dashboards. An attacker does not need an account or any credentials to interact with these shared components. However, dashboards or cards that are not shared publicly or do not utilize the vulnerable field-filter (dimension) parameters are not susceptible to this specific trigger path.

Why is this CVE considered high risk based on Halo Surface Signal?

Halo Surface Signal indicates this is very likely to be a concern because the vulnerability exists within public-facing sharing features. Since Metabase is intentionally designed to publish dashboards to the internet, these specific components are often exposed by default, making them reachable to anyone online without requiring complex access.

What is the first step I should take to address this?

Begin by auditing your Metabase environment to inventory all publicly shared cards and dashboards. Identify which of these utilize field-filter or dimension parameters. Once identified, evaluate whether the public availability of these specific items is necessary, and prioritize restricting or disabling public access for any dashboards that handle sensitive database information.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.