CVE-2026-72899

No fix known EPSS <1%CVSS 10.0

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

Published 2026-08-10 · CVE record · OSV

Products: metabase