0xBlackash/CVE-2026-72898

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a safe version checker for CVE-2026-72898. It reads the public /api/session/properties endpoint of a Metabase instance to determine the version and compares it against known fixed versions to report if the instance is vulnerable. It contains no exploit or SQL injection payloads.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README documenting CVE-2026-72898 and a Python version-checker script. The script only reads the public /api/session/properties endpoint to determine the Metabase version and compares it against known fixed versions. No exploit code, SQL injection, command execution, or any other harmful behavior is present. The script's behavior matches its documented purpose.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareMetabase
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script explicitly states it is a 'SAFE version checker only' with 'NO SQL injection, NO exploit payloads, NO side effects'. It only reads a public endpoint and compares the version, which is scanner behavior.

metabase_cve_2026_72898_safe_check.py:2-5

Requirements

  • Target must be a Metabase instance with the /api/session/properties endpoint accessible.metabase_cve_2026_72898_safe_check.py:77-78

Observed behavior

  • Sends a GET request to /api/session/properties to retrieve the Metabase version tag.metabase_cve_2026_72898_safe_check.py:77-91
  • Parses the version and compares it against a hardcoded list of fixed versions to determine vulnerability status.metabase_cve_2026_72898_safe_check.py:41-70
  • Prints a 'VULNERABLE' or 'SAFE' message based on the version comparison.metabase_cve_2026_72898_safe_check.py:110-119
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
/api/session/propertiesThe only endpoint contacted by the checker script; it is a public, read-only Metabase endpoint used to retrieve version information.metabase_cve_2026_72898_safe_check.py:77
Review boundaries

What the analysis did not establish

  • Only the two text files in the repository were reviewed; no other files exist in the snapshot.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1