CISA added Metabase CVE-2026-72898 to KEV after the vendor confirmed active attacks. Self-hosted administrators should move to a fixed release, validate access, and review sensitive connections.