Latest Product Updates and Feature Enhancements on Metabase
U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities ca...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Metabase SQL injection vulnerability (CVE-2026-72898) to its Known Exploited Vulnerabilities catalog. This flaw allows attacke...rs to inject arbitrary SQL into the Metabase application database, potentially compromising sensitive data. Metabase quickly patched the vulnerability for its cloud customers, but self-hosted users must urgently update.
Warning: Actively exploited SQL injection in Metabase, Patch ...
Metabase has identified a critical SQL injection vulnerability in its software versions ranging from x.58.0 to x.63.3. This flaw allows unauthenticated attackers to gain administrator access via the .../api/session/reset_password endpoint, potentially leading to data breaches and system compromise. Metabase advises immediate patching to versions x.58.24 and above to mitigate the risk.
Metabase has released new versions focused on security improvements, addressing vulnerabilities identified in recent research. The updates include hardened APIs and other security enhancements. Users... are encouraged to upgrade to the latest versions, such as v0.63.13, to ensure protection.
A critical SQL injection vulnerability in Metabase, identified as CVE-2026-72898, allows remote attackers to gain administrator-level control, posing significant risks to connected data sources. CISA... added this flaw to its Known Exploited Vulnerabilities catalog, urging immediate patching by August 14, 2026. Organizations using Metabase should prioritize mitigation to prevent unauthorized access and data exposure.
Metabase has released a security update to address a critical vulnerability that allows attackers to execute SQL malicious code and gain full control of instances. Admins are urged to install the sec...ured versions 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5, and take additional steps like revoking active sessions and rotating credentials to protect their systems.
Metabase Patches Vulnerability Exploited as Zero-Day
Metabase released patches for a critical SQL injection vulnerability exploited as a zero-day. The flaw allowed attackers to gain administrative access to Metabase's database. Metabase Cloud instances... are updated, and self-hosting users are urged to apply patches. The vulnerability affects Metabase versions 63.5, 62.9, 61.11, 60.17, 59.21, and 58.24.
Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access
Metabase confirmed a critical zero-day vulnerability, GHSA-vwf4-m7j8-wcjf, affecting versions 1.58 onward, allowing attackers to gain admin access via SQL injection. The flaw was exploited on Metabas...e Cloud, prompting a patch. Self-hosted users must update immediately to prevent data breaches, as seen with Framework and Tally. The vulnerability underscores the risk of BI tools in data ecosystems.
Metabase Zero-Day Exploited in Wild Allows Admin Access Without ...
Metabase disclosed a critical zero-day vulnerability in its business intelligence software, allowing unauthorized SQL injection and admin access. The flaw, affecting versions 1.58 and above, has been... exploited in the wild. Metabase has released patches and advised users to update immediately. Companies like Framework and n8n have reported data breaches linked to this vulnerability.
Metabase Zero-Day, N-able Hotfix 2, and Kemp Flaw Exploited ...
Metabase faces a critical zero-day vulnerability in its self-hosted instances, allowing unauthenticated attackers to gain full administrative access and extract database credentials. The flaw affects... versions x.58.0 and above. Users are urged to apply the latest security patches to prevent unauthorized data access and system compromise.
Metabase emergency patch: SQL injection rated CVSS 10.0 is being ...
Metabase released an emergency patch for two critical SQL injection vulnerabilities, one rated CVSS 10.0, which could allow attackers to gain administrator rights. The flaws affect several Metabase v...ersions, and the company advises immediate updates and follow-up actions to secure database credentials and prevent unauthorized access.
Metabase Urges Self-Hosted Users to Patch Critical SQL Flaw
Metabase has identified and patched a critical SQL vulnerability affecting self-hosted users, urging them to update to fixed releases. The flaw allows unauthenticated attackers to inject SQL, with co...nfirmed exploitation. Cloud customers are already secure. The advisory provides guidance for immediate upgrades and temporary workarounds for those unable to update.
Metabase has released a security update to address a zero-day vulnerability affecting versions 1.58 and above. The vulnerability allowed attackers to inject arbitrary SQL, potentially compromising us...er data. Metabase Cloud instances have been patched, while self-hosted users are advised to upgrade to the latest point release to secure their systems.
Introducing the Claude skill for learning Metabase
Metabase introduces the Claude skill, an AI-driven tool designed to enhance learning of its platform. This skill uses interactive methods like the Socratic Method and personalized data examples to en...gage users actively. It tracks progress and employs spaced-repetition for effective learning, making it more dynamic than static guides.
Metabase: PoC Exploit Released for Critical Metabase Enterprise RCE ...
A critical remote code execution (RCE) vulnerability, CVE-2026-33725, was discovered in Metabase Enterprise, affecting versions 1.47.0 to 1.59.3. The flaw allows unauthenticated attackers to execute ...arbitrary code. A proof-of-concept exploit has been released, increasing the risk of attacks. Metabase has issued patches for versions 1.59.4, 1.58.10, and 1.57.16 to mitigate the issue.
PoC Exploit Released for Critical Metabase Enterprise RCE Vulnerability
A proof-of-concept exploit has been released for a critical remote code execution vulnerability in Metabase Enterprise. This vulnerability poses significant security risks to users of the platform.
Metabase Enterprise RCE Flaw Now Has Public Proof-of-Concept Exploit
A public proof-of-concept exploit has been released for a remote code execution (RCE) flaw in Metabase Enterprise. This vulnerability could allow attackers to execute arbitrary code on affected syste...ms, posing significant security risks for users of the Metabase Enterprise platform.
Metabase CVE-2023-38646 Still Exposes Thousands of Servers
A critical vulnerability, CVE-2023-38646, in Metabase's open-source and enterprise versions allows unauthenticated remote code execution, risking full system compromise. Over 17,000 Metabase instance...s remain exposed. Users must update to the latest versions to mitigate this threat.
Meet Data Studio: tools to curate your semantic layer in Metabase
Metabase has launched Data Studio, a new feature within its platform designed to help teams manage their semantic layer effectively. Data Studio offers tools like a library for trusted analytics cont...ent, a glossary for business terms, and a dependency graph to visualize content connections. It is available in both open-source and enterprise editions, allowing users to transform raw data into analytics-ready datasets.
Lessons learned from building AI analytics agents: build for chaos
Metabase shares insights from developing Metabot, an AI analytics agent, emphasizing the importance of context engineering over prompt engineering. The team learned to handle production chaos by opti...mizing data representations, providing just-in-time instructions, and offering explicit error guidance. Metabot is now out of beta, allowing users to experience these improvements firsthand.
