← Back to browse · API

CVE-2026-72899

Severity
CRITICAL
CVSS
10.0
EPSS
0.00566
Risk score
40.2
CISA KEV
No
PoC
Yes
Published
2026-08-10
Modified
2026-08-11
First seen
2026-08-10
Aliases
EUVD-2026-55691
Products
metabase:Metabase x.58.0 <x.58.24, metabase:Metabase x.59.0 <x.59.21, metabase:Metabase x.60.0 <x.60.17, metabase:Metabase x.61.0 <x.61.11, metabase:Metabase x.62.0 <x.62.9, metabase:Metabase x.63.0 <x.63.5
Sources
nvd CVE-2026-72899
packetstorm e274c9c76002c8cfdd231761|CVE-2026-72899
euvd EUVD-2026-55691

Description

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

References