alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Metabase Password Reset SQL Injection (CVE-2026-72898)"; flow:established,to_server; http.uri; content:"/api/session/reset_password"; fast_pattern; http.request_body; strip_whitespace; pcre:"/\x7b\x22(?:select|union|delete|insert|waitfor|case|limit|benchmark|update|create|alter|drop|truncate|join)\x22\x3a\x5b/i"; http.method; content:"POST"; reference:url,cloud.projectdiscovery.io/library/CVE-2026-72898; reference:cve,2026-72898; classtype:attempted-user; sid:2071536; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2026_08_14, cve CVE_2026_72898, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2026_08_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)