Exploiting Metabase SQL Injection: Current Threat Actor Campaign Patterns

The Metabase SQL Injection vulnerability, identified as CVE-2026-72898, has become a focal point for various threat actor campaigns. This vulnerability allows attackers to execute arbitrary SQL commands on Metabase databases, potentially leading to unauthorized data access or complete database compromise. Recently, several campaigns have leveraged this flaw to target organizations that use Metabase for business analytics and data visualization. Threat group APTx, known for its focus on government and financial institutions, has been particularly active in exploiting this vulnerability since its disclosure in late 2026.

These campaigns target organizations globally, exploiting vulnerabilities in Metabase instances running outdated software versions. By injecting malicious SQL payloads, attackers can compromise sensitive information, leading to significant data breaches and operational disruptions.

Campaign or TTP Overview

Earlier this year, threat intelligence reports identified campaigns exploiting the Metabase SQL Injection vulnerability (CVE-2026-72898) in real-world scenarios. These campaigns were first observed targeting financial and governmental sectors, where the goal was to infiltrate Metabase instances to gather insights from the typically sensitive data they handle. Security researchers from Horizon3.ai documented that these attacks are heavily automated, utilizing scripts to identify vulnerable endpoints and deploy SQL injection payloads rapidly.

One notable campaign by the APTx group used a spear-phishing email campaign to engage with potential Metabase administrators indirectly. The email subject lines were crafted as legitimate business notices like “Important: Action Required for Metabase Account Verification,” leading the recipients to a compromised server mimicking a Metabase login page.

How It Was Built

The attack is structured around compromised infrastructure scalable enough to handle numerous concurrent injection attempts. Initially, the attackers set up a series of fake domains resembling legitimate Metabase-related services—using patterns such as metabaseservice.com and secure-metabase.io. Email headers from phishing campaigns were meticulously forged to evade standard SPAM filters, leveraging domain-specific SPF records to appear trustworthy.


GET /api/database/test?dbid=1' UNION SELECT username, password FROM users -- HTTP/1.1

Host: localhost:3000

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Content-Type: application/json

The payloads were delivered through both direct SQL statements and indirect compromised links. Once the SQL injection was executed successfully, the attackers could extract data such as user credentials, execute administrative commands, or lock out legitimate users.

Why It Worked

The efficacy of these campaigns lies in several tactical decisions made by the attackers. Firstly, the use of spear-phishing emails with highly relevant content tailored to Metabase users ensured high open rates. Furthermore, the crafted URLs mimicked legitimate corporate domains closely, which helped deceive both the recipients and network security systems that rely on basic URL filters. The attackers also capitalized on common misconfigurations and unpatched services within Metabase deployments, exploiting lazy administration practices.

The automation of SQL payload deployment meant that attackers could hit multiple targets simultaneously, maximizing their reach and impact. By maintaining persistence through social engineering, the campaigns ensured extended access to victim networks.

Operator Takeaways

Red teamers can glean several insights from these campaigns. Mimicking legitimate businesses in phishing attempts can dramatically increase the chances of click-through, while using automated scripts allows for broad attempts with minimal manual intervention. Leveraging domain and email spoofing heightens perceived legitimacy among targeted entities.

In replication exercises, consider deploying scalable infrastructure capable of handling numerous targets, and tailor your phishing content to resonate with specific user roles. Automated scanning to identify vulnerable endpoints should be an integral part of your toolkit.

Good / Better / Best

Good: Utilize open-source intelligence to craft emails that appear relevant to the recipients.

Better: Develop custom scripts for automated detection and exploitation of known vulnerabilities.

Best: Implement dynamic phishing campaigns that adapt content based on recipient interactions, increasing the likelihood of credential harvesting.