Inside the Metabase SQLi: Exploited in the Wild
Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense.
Summary from Wiz Blog.
Explained
The technology and terms in this story. Learn more
- WeaknessSQL injectionSlipping database commands into input an application passes to its database.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.