CVE-2026-72898

Sentinel/Defender KQL

let MetabaseLogs = YourMetabaseLogTable
| where Url contains "/api/session/reset_password"
| where HttpMethod == "POST"
| where isnotempty(RequestBody) or isnotempty(QueryParameters)
| where RequestBody contains "'" or RequestBody contains "--" or RequestBody contains "union" or RequestBody contains "select" or RequestBody contains "waitfor delay"
| project TimeGenerated, SourceIp, UserName, UserAgent, Url, RequestBody, HttpMethod;
MetabaseLogs
| join kind=leftouter (
    YourMetabaseLogTable
    | where TimeGenerated > ago(1h) // Look for subsequent admin actions within 1 hour
    | where Url contains "/api/session/" and not (Url contains "/api/session/reset_password") // Exclude the reset_password endpoint itself
    | where UserName == "admin" or RequestBody contains "admin" // Look for admin-related actions
    | project TimeGenerated, SourceIp, UserName, Url, RequestBody, HttpMethod, SubsequentAdminAction = true
) on SourceIp
| where SubsequentAdminAction == true
| project-rename InitialAttackTime = TimeGenerated, SubsequentAdminActionTime = TimeGenerated1
| extend Description = "Potential Metabase SQL Injection followed by admin activity via /api/session/reset_password endpoint."

Splunk SPL

sourcetype=metabase_logs uri="/api/session/reset_password" method="POST" (body="'" OR body="--" OR body="union" OR body="select" OR body="waitfor delay")
| eval initial_attack_time = _time
| join type=left max=1000 initial_attack_time [ search sourcetype=metabase_logs _time > relative_time(initial_attack_time, "-1h") _time < relative_time(initial_attack_time, "+1h") uri="/api/session/*" NOT uri="/api/session/reset_password" (user="admin" OR body="admin")
| eval subsequent_admin_action = "true" ]
| where subsequent_admin_action="true"
| table _time, initial_attack_time, subsequent_admin_action, src_ip, user, uri, body, method
| rename _time as subsequent_admin_action_time
| eval Description = "Potential Metabase SQL Injection followed by admin activity via /api/session/reset_password endpoint."

Sigma

title: Metabase SQL Injection via Reset Password
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential SQL injection attempts against the Metabase /api/session/reset_password endpoint followed by suspicious administrative actions.
author: SecBoard
date: 2026/08/06
references:
  - https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
tags:
  - attack.initial_access
  - attack.persistence
  - cve.2026.72898
logsource:
  product: metabase
  service: web_access
detection:
  selection_reset_password:
    url|contains: '/api/session/reset_password'
    method: 'POST'
    body|contains:
      - "'"
      - "--"
      - "union"
      - "select"
      - "waitfor delay"
  selection_admin_activity:
    url|contains: '/api/session/'
    url|excludes: '/api/session/reset_password'
    user|contains: 'admin'
  condition: selection_reset_password and selection_admin_activity
  timeframe: 1h
falsepositives:
  - Legitimate administrative actions if not correlated with injection attempts.
level: critical

Elastic ES|QL

FROM metabase_logs
| WHERE url LIKE '/api/session/reset_password%'
  AND http.request.method == 'POST'
  AND (http.request.body.content LIKE '%''%' OR http.request.body.content LIKE '%--%' OR http.request.body.content LIKE '%union%' OR http.request.body.content LIKE '%select%' OR http.request.body.content LIKE '%waitfor delay%')
| JOIN kind=left (
    FROM metabase_logs
    | WHERE event.timestamp > (NOW() - INTERVAL 1 HOUR)
      AND url LIKE '/api/session/%'
      AND NOT url LIKE '/api/session/reset_password%'
      AND (user.name == 'admin' OR http.request.body.content LIKE '%admin%')
    | SELECT @timestamp AS subsequent_admin_action_time, source.ip AS subsequent_source_ip, user.name AS subsequent_user_name, url AS subsequent_url, http.request.body.content AS subsequent_request_body
  )
  ON source.ip
| WHERE subsequent_admin_action_time IS NOT NULL
| SELECT @timestamp AS initial_attack_time, source.ip, user.name, url, http.request.body.content, http.request.method, subsequent_admin_action_time, subsequent_url, subsequent_user_name
| SET Description = 'Potential Metabase SQL Injection followed by admin activity via /api/session/reset_password endpoint.'