This repository contains the hotfix for CVE-2026-72898, an unauthenticated SQL Injection vulnerability in the setup endpoint of self-hosted Metabase instances.
Left unpatched, attackers can bypass the setup token validation, execute arbitrary database commands, and extract data warehouse credentials.
The validate-setup-token function previously accepted unvalidated user input and concatenated it directly into a raw JDBC string. This allowed an attacker to break out of the SQL string and append malicious commands.
This patch fundamentally shifts the validation mechanism to neutralize SQL injection vectors:
- ORM Integration: Migrates database queries from raw strings to Toucan 2 (
t2), Metabase's native Object-Relational Mapper. - Input Isolation: The system no longer passes user input into the database to verify the token. Instead, it queries the database for the expected token using strict parameterization.
- In-Memory Validation: Uses
crypto.equality/eq?to compare the tokens in application memory (Clojure) rather than in the database. - Timing Attack Resistance: The
crypto.equality/eq?function executes in constant time, preventing attackers from brute-forcing the token via timing discrepancies.
Replaces the vulnerable raw jdbc/query logic in metabase.api.setup.
Metabase is licensed under the AGPL. This patch is provided under the same terms.