CISA has added the Metabase SQL injection zero-day exploitation vulnerability to its Known Exploited Vulnerabilities catalog with a mandatory patch deadline of August 14, 2026 — giving organizations running self-hosted Metabase instances just 48 hours to apply emergency patches before non-compliance enforcement under BOD 26-04. The addition marks the first time the vulnerability has received an official CVE identifier, CVE-2026-72898, after CISA added it to the KEV catalog on August 11.
How the SQL Injection Vulnerability Enables Data Access
CVE-2026-72898 allows an unauthenticated remote attacker to inject arbitrary SQL queries into the Metabase application database, granting administrator access to every connected downstream data source including customer databases, HR systems, and financial records. The flaw operates at the SQL query endpoint layer — an attacker can send crafted queries directly against the application’s database interface without any authentication, allowing them to read, modify, or delete any data stored in connected databases through a single injection point.
CVSS remains at 10.0 for this vulnerability. Metabase assigned the CVE identifier after CISA designated it to the KEV catalog — the vendor had previously disclosed the vulnerability around August 3 with initial wild exploitation reports confirming victims including Framework, Tally, and LexisNexis as third-party organizations affected by attackers exploiting the SQL injection through their self-hosted instances.
Timeline from Initial Disclosure to CISA Enforcement Action
Initial reports of Metabase zero-day exploitation surfaced around August 3 in the wild, with unauthenticated attackers beginning targeted attacks against self-hosted Metabase analytics platforms running versions at or above the 0.58 release series. Metabase disclosed the vulnerability affecting those versions but did not initially assign a CVE identifier to the flaw.
The CISA KEV addition on August 11 elevated the threat from an active exploitation incident to a mandatory federal patching requirement under Emergency Directive BOD 26-04, with the August 14 deadline creating exactly 48 hours of compliance window. Every U.S. federal and state agency running self-hosted Metabase instances now faces enforcement action if patches are not applied by the deadline — an uncommonly tight timeline even for emergency directives.
Federal and Enterprise Scope of CVE-2026-72898 Under BOD 26-04
Metabase runs on thousands of servers across U.S. federal agencies, including CDC, NASA, and GSA, as a central analytics platform for querying operational databases — organizations that use its dashboarding capabilities to connect sensitive production data sources directly through Metabase. The KEV design The scope of potential data exposure is massive: any connected database becomes a one-click pivot point for attackers who can read or modify customer records, HR information, and financial data without authentication through the SQL injection vector.
Organizations that cannot immediately patch should isolate all Metabase instances from untrusted networks and disable the SQL query endpoint as an emergency mitigation while monitoring downstream database access logs for unauthorized queries executed since approximately August 3 when initial exploitation activity was first confirmed.
