← Database

CVE-2026-72899

CRITICAL CVSS: 10.0 Published: 2026-08-10 Modified: 2026-08-11

Description

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

Affected Platforms

Unknown

Weakness Type

CWE-89

References