Latest News & Updates on Metabase

Metabase disclosed a critical zero-day vulnerability in its business intelligence software, allowing unauthorized SQL injection and admin access. The flaw, affecting versions 1.58 and above, has been... exploited in the wild. Metabase has released patches and advised users to update immediately. Companies like Framework and n8n have reported data breaches linked to this vulnerability.
Show More..

Metabase faces a critical zero-day vulnerability in its self-hosted instances, allowing unauthenticated attackers to gain full administrative access and extract database credentials. The flaw affects... versions x.58.0 and above. Users are urged to apply the latest security patches to prevent unauthorized data access and system compromise.
Show More..

Metabase released an emergency patch for two critical SQL injection vulnerabilities, one rated CVSS 10.0, which could allow attackers to gain administrator rights. The flaws affect several Metabase v...ersions, and the company advises immediate updates and follow-up actions to secure database credentials and prevent unauthorized access.
Show More..

Metabase has identified and patched a critical SQL vulnerability affecting self-hosted users, urging them to update to fixed releases. The flaw allows unauthenticated attackers to inject SQL, with co...nfirmed exploitation. Cloud customers are already secure. The advisory provides guidance for immediate upgrades and temporary workarounds for those unable to update.
Show More..

Metabase has released a security update to address a zero-day vulnerability affecting versions 1.58 and above. The vulnerability allowed attackers to inject arbitrary SQL, potentially compromising us...er data. Metabase Cloud instances have been patched, while self-hosted users are advised to upgrade to the latest point release to secure their systems.
Show More..

A public proof-of-concept exploit has been released for a remote code execution (RCE) flaw in Metabase Enterprise. This vulnerability could allow attackers to execute arbitrary code on affected syste...ms, posing significant security risks for users of the Metabase Enterprise platform.
Show More..

A proof-of-concept exploit has been released for a critical remote code execution vulnerability in Metabase Enterprise. This vulnerability poses significant security risks to users of the platform.

A critical remote code execution (RCE) vulnerability, CVE-2026-33725, was discovered in Metabase Enterprise, affecting versions 1.47.0 to 1.59.3. The flaw allows unauthenticated attackers to execute ...arbitrary code. A proof-of-concept exploit has been released, increasing the risk of attacks. Metabase has issued patches for versions 1.59.4, 1.58.10, and 1.57.16 to mitigate the issue.
Show More..

A critical vulnerability, CVE-2023-38646, in Metabase's open-source and enterprise versions allows unauthenticated remote code execution, risking full system compromise. Over 17,000 Metabase instance...s remain exposed. Users must update to the latest versions to mitigate this threat.
Show More..

Metabase has launched Data Studio, a new feature within its platform designed to help teams manage their semantic layer effectively. Data Studio offers tools like a library for trusted analytics cont...ent, a glossary for business terms, and a dependency graph to visualize content connections. It is available in both open-source and enterprise editions, allowing users to transform raw data into analytics-ready datasets.
Show More..

Metabase shares insights from developing Metabot, an AI analytics agent, emphasizing the importance of context engineering over prompt engineering. The team learned to handle production chaos by opti...mizing data representations, providing just-in-time instructions, and offering explicit error guidance. Metabot is now out of beta, allowing users to experience these improvements firsthand.
Show More..