Metabase SQL Injection Vulnerability Exploitation in the Wild

In recent months, Metabase, a popular open-source business intelligence tool, was found to have a critical SQL injection vulnerability identified as CVE-2026-72898. This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands to gain unauthorized administrator access. The exploitation of this vulnerability has been observed in the wild, with sophisticated attackers targeting a variety of organizations leveraging Metabase, aiming to exfiltrate sensitive data and escalate privileges.

Campaign or TTP Overview

Metabase’s SQL injection vulnerability came to light in early 2026, attracting skilled threat actors looking to exploit weak points in unpatched systems. The campaigns involved attackers gaining access to internal company analytics and dashboards where Metabase was used without stringent access controls. Attackers primarily targeted organizations that had outdated Metabase versions exposed to the internet, notably in the sectors of finance, healthcare, and tech. These industries were selected due to the valuable data obtainable through dashboards and the potential for critical insight extraction.

While attribution remains complex, some of the activity has been linked to state-sponsored groups known for targeting large enterprises for espionage. The initial wave of exploits gained traction shortly after the vulnerability was added to the CISA Known Exploited Vulnerabilities Catalog, further indicating the seriousness of this threat.

How It Was Built

The attack execution involved meticulous planning with substantial understanding of Metabase’s backend architecture. The first phase involved a reconnaissance to identify vulnerable Metabase instances using scanning tools or publicly available datasets that might indicate the presence of such systems.

To deliver the payload, attackers prepared crafted SQL statements capable of executing administrative operations. The injection was typically placed within user input fields or URL parameters that were not sanitized properly. An example SQL payload designed to escalate privileges is:


SELECT user_id, CONCAT(username, ':', password) AS user_pass FROM users WHERE ' OR '1'='1;

Once the SQL code was in place, attackers could set up backdoor access or siphon off data by modifying user privileges. The following SQL command was often reported in use:


UPDATE users SET role = 'admin' WHERE username='target_user';

With administrative privileges secured, it allowed full access to view and manipulate the datasets hosted on Metabase dashboards.

Why It Worked

The success of these attacks hinged on specific, effective techniques:

Reconnaissance Strategy: Attackers were diligent in identifying exposed Metabase instances, often using search engines or leveraging leaked internal documentation to confirm potential targets.
Crafting Unfiltered SQL: The attackers capitalized on improper input validation. SQL payloads were meticulously designed to bypass basic controls by intertwining logic operators with SQL commands that executed unchallenged.
Operating Stealthily: Once access was obtained, attackers did not immediately commence large-scale data extraction. Instead, they conducted phased data exfiltration, minimizing bandwidth spikes and thus avoiding detection by anomaly-based monitoring systems.

Operator Takeaways

Learning from this campaign provides tactical insights for a red team operator. The key takeaways for developing similar, realistic simulations include:

Leverage open-source intelligence (OSINT) tools to emulate reconnaissance processes, identifying outdated software versions possibly in use by a target.
Create multifaceted SQL payloads that can achieve specific objectives like privilege escalation or data modification, keeping them obscured from standard detection mechanisms.
Employ gradual, targeted data exfiltration methods that avoid triggering suspicion due to unusual activity spikes over network monitoring frameworks.

Do’s and Don’ts

Do’s

Research Current Vulnerabilities: Continuously update your knowledge base about the latest vulnerabilities and how they are exploited practically in different environments.
Simulate Real-Life Scenarios: Adapt attack patterns from known campaigns to create simulations that realistically stress test your client’s defensive capabilities.

Don’ts

Overlook Minor Systems: Do not ignore smaller, less-critical systems during simulations, as they often provide gateway access points.
Ignore Network Anomalies: In developing simulations, account for traffic analysis tools and design data exfiltration strategies that mimic legitimate use patterns.

References

CISA Known Exploited Vulnerabilities Catalog