Singapore warns of attacks on Metabase flaw rated 10 out of 10

Singapore warns of attacks on Metabase flaw rated 10 out of 10

10 November 2026: Singapore's Cyber Security Agency issued an alert on 4 November telling Metabase users to patch at once, because attackers are exploiting CVE-2026-72898 to inject SQL and gain administrator access without logging in. The flaw scores 10.0 out of 10 on CVSS v3.1, and a proof-of-concept exploit is public.

Not yet independently verified. The flaw and its patches are not new. Metabase published its advisory on 6 August 2026, and the new element is the Singapore alert of 4 November. CSA does not say how many systems were attacked or where, and we found no count from any other source. We will update this when it can be confirmed, and remove this note.

A patch three months old, and attacks still running

Metabase disclosed this bug on 6 August 2026, after finding that its own cloud service had been attacked through what was then an unknown flaw in versions 1.58 and above. It blocked the endpoints used, patched the cloud service and told self-hosting customers they might be exposed. CSA gives no reason for raising the matter again in November and offers no figures. Anyone who took the August release has nothing further to patch. A team that runs Metabase on its own server and has not upgraded since summer is the group this alert is aimed at.

Versions to check

CSA lists these as affected, with the open source numbering first and the Enterprise numbering in brackets:

• 0.58.0 before 0.58.24 (1.58.0 before 1.58.24)
• 0.59.0 before 0.59.21 (1.59.0 before 1.59.21)
• 0.60.0 before 0.60.17 (1.60.0 before 1.60.17)
• 0.61.0 before 0.61.11 (1.61.0 before 1.61.11)
• 0.62.0 before 0.62.9 (1.62.0 before 1.62.9)
• 0.63.0 before 0.63.5 (1.63.0 before 1.63.5)

Those are the minimum safe builds, and the newest release in your line is the better target.

Patching alone does not end the job

An instance that was reachable from the internet while unpatched may already have been entered, so upgrading only closes the door. CSA points self-hosters of publicly accessible servers to Metabase's post-upgrade guidance, which has four parts: revoke active user sessions, review administrator accounts and API keys, rotate the credentials for connected databases, and check the logs for unauthorised activity.

The third of those is the expensive one. Metabase says an attacker with administrator access could steal the stored credentials for connected databases, read any data available through those connections and export it. Rotation therefore means every warehouse and replica that Metabase can reach, and the review should extend to the logs of those databases, which Metabase's own list also asks for.

If an upgrade cannot happen today, CSA's temporary workaround is to block access to the /api/session/reset_password endpoint at a proxy or firewall. That buys time and does not replace the update.

Sources

• Cyber Security Agency of Singapore, alert AL-2026-158, 4 November 2026
• Metabase security advisory GHSA-vwf4-m7j8-wcjf, 6 August 2026
• Metabase blog, security update, 6 August 2026