Singapore's Cyber Security Agency (CSA) warned on 4 November 2026 that attackers are actively exploiting a critical flaw in Metabase, the open-source business intelligence platform, and urged organisations running it to patch immediately. The vulnerability, CVE-2026-72898, carries the maximum CVSS score of 10.0 out of 10.

The flaw is an unauthenticated SQL injection in Metabase's password-reset endpoint, /api/session/reset_password, which lets a remote attacker inject arbitrary SQL into the Metabase application database and gain administrator access to the instance. From there, an attacker can also reach the credentials for every database connected to the platform. A proof-of-concept exploit is publicly available, and Metabase has confirmed active exploitation.

Fixed in August — but unpatched instances remain exposed

This is not a new vulnerability. Metabase fixed it on 6 August 2026, and the US agency CISA added it to its Known Exploited Vulnerabilities catalogue on 11 August. The new hook is the CSA alert: three months after the fix, the flaw is still being actively exploited against instances that were never updated. No business has been named as a victim, and none of the sources checked says what data, if any, was taken.

Versions 58 and later are affected, in both the free edition (0.x) and the paid edition (1.x), while versions below 58 are not affected. The minimum safe releases are 58.24, 59.21, 60.17, 61.11, 62.9 and 63.5. The CSA advises updating to the patched version for the release line in use immediately, and, if that is not possible, blocking access to the /api/session/reset_password endpoint as a temporary workaround. Organisations with publicly accessible self-hosted instances should also follow Metabase's post-upgrade security guidance to check whether administrator accounts were compromised before patching.

Sources: Cyber Security Agency of Singapore, Active exploitation of Metabase vulnerability, alert AL-2026-158, 4 November 2026; Brotherly Technology, 4 November 2026; Metabase security advisory GHSA-vwf4-m7j8-wcjf.