Vulnerability Analysis: CVE-2026-72898 Metabase – Unauthenticated SQL Injection
Introduction In modern enterprise architectures, business intelligence (BI) platforms such as Metabase serve as central data gateways, aggregating access to production databases, data warehouses, and identity management systems. Consequently, vulnerabilities within BI platforms pose severe systemic risks to an organization’s entire digital infrastructure. In early August 2026, a critical security flaw identified as CVE-2026-72898 (GitHub Advisory ID: GHSA-vwf4-m7j8-wcjf) was publicly disclosed and documented as an active zero-day threat being