Vulnerabilities & Exploits · Web App Attack

Metabase Exploitation Exposes Connected Databases

CSIRT Italia said on August 11 that Metabase CVE-2026-72898 is being actively exploited in the wild, while NCSC-NL separately issued a Power BI Server advisory for CVE-2026-65811. Metabase’s fixes cover affected x.58 through x.63 branches.

The Metabase flaw sits in the password-reset path: attacker-supplied SQL can slip past the login checks and land an attacker in an admin session. Once inside, Metabase can expose the database credentials it stores for connected systems, so the problem is not limited to the dashboard itself.

For teams that use BI tools as the front end to internal data, the durable exposure is whatever databases the platform can already reach. The Power BI issue is a different class of problem: it needs prior authentication and, unlike Metabase, was not reported as exploited.

7 sources · Aug 12

Timeline

• Aug 14 CISA federal deadline for CVE-2026-72898
• Aug 12 Reported by NCSC-NL Advisories
• Aug 11 Reported by Dark Reading
• Aug 8 Reported by The Hacker News

Sources

• Aug 12 NCSC-NL Advisories

  Kwetsbaarheid verholpen in Microsoft Power BI server

  Microsoft heeft een kwetsbaarheid verholpen in Power BI server.

  original

• Aug 11 CSIRT Italia / ACN

  Risolte vulnerabilità in Metabase

  Tra queste si evidenzia la CVE-2026-72898, che risulta sfruttata attivamente in rete.

  original

• Aug 11 Dark Reading

  Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius

  The max-severity vuln, which still has no CVE, allows malicious, remote administrator access to the business-analytics platform and its downstream users.

  original

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-08-09

Every edition of this story: Metabase Exploitation Exposes Connected Databases

More from today

• Rovo's Toggle Fails as a Data Boundary