CVE-2026-72899
CRITICAL
NVD
CVSS Score
10
Severity
CRITICAL
Published
Aug 10, 2026
Vendor
unknown
Description
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.