title: Metabase Password Reset SQL Injection Attempt
id: fbeecaf9-c9de-4071-b9c6-3576b195e679
status: experimental
description: >
    A request to Metabase's unauthenticated password-reset endpoint carrying
    SQL metacharacters. CVE-2026-72898 is an unauthenticated SQL injection in
    /api/session/reset_password that yields administrator access to the
    Metabase instance, and through it every database connection that instance
    holds. Metabase confirmed active exploitation on the day of disclosure,
    6 August 2026, and CISA added the CVE to the KEV catalog on 11 August.
    The vendor's own interim workaround is to block this endpoint outright, so
    on a patched and hardened instance any match here is worth review.
    Limitation: this matches metacharacters in the request line only. An
    exploit that carries its payload in the POST body is invisible to
    webserver-category logs, so pair this with body-capturing proxy or WAF
    logs and with the volume hunt in the writeup.
references:
    - https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
    - https://www.cve.org/CVERecord?id=CVE-2026-72898
    - https://attack.mitre.org/techniques/T1190/
    - https://umbrasec.dev/research/mathspace-metabase-internal-tooling.html
author: UMBRASEC
date: 2026/09/17
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
detection:
    endpoint:
        cs-uri-stem|contains: '/api/session/reset_password'
    sqli_markers:
        cs-uri-query|contains:
            - ''''
            - ' or '
            - ' and '
            - 'union'
            - 'select'
            - 'sleep('
            - 'pg_sleep'
            - '--'
            - '/*'
            - ';'
    condition: endpoint and sqli_markers
falsepositives:
    - Vulnerability scanners probing the path after public disclosure
    - Authorised security testing against the patched endpoint
    - A password-reset token that legitimately contains a matched character,
      which is why the markers are matched in the query string rather than
      across the whole request
level: high