PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Security update available for Metabase - Please upgrade now

metabase.com | blog | #cloud | #zero-day | #sql-injection | #metabase | #self-hosted | #security-advisory | #upgrade
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Metabase patched a 0-day in versions 1.58+ exploited against its Cloud: the reset_password endpoint allowed SQL injection, admin takeover and credential theft — self-hosted users must upgrade.
Published
Collected

Related coverage

blog · metabase.com
Security update available for Metabase - Please upgrade now
Metabase reveals a patched 0-day exploited on Cloud in versions 1.58+: attackers could inject SQL into the app database for admin access and credential theft; self-hosted users should upgrade now.
blog · metabase.com
Security update available for Metabase - Please upgrade now
Metabase patched an info-leak flaw that lets authenticated users, including embedding users, retrieve database credentials. Self-hosted instances must upgrade now; Metabase Cloud is already patched.
blog · metabase.com
Security-focused Metabase Release Announcement
This coverage gives security teams current context for monitoring, validation, and remediation.
vulnerability · bishopfox.com
Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898
A critical unauthenticated SQL injection in Metabase's password reset endpoint (CVE-2026-72898, CVSS 10.0) allows arbitrary SQL against the application database; active exploitation is confirmed.
blog · metabase.com
'Wait, you don't have a semantic layer yet?' AI analytics readiness pulse
We asked 73 data people about AI Analytics: 59% are already using AI with their data, 44% want it all self-hosted, and 31% of poll voters don’t know what a semantic layer is. A small, unscientific snapshot from AI Analytics Week.
blog · metabase.com
We don't use PHP
We don't use PHP at Metabase, and we removed eMudhra-related certificates in a recent update.
Back