Metabase said on August 6, 2026, that it identified and patched a security flaw and urged self-hosted customers to update. Cloud customers are already patched.
Quick Summary – TLDR:
- According to Metabase advisory, the issue is Critical and an unauthenticated remote attacker can inject arbitrary SQL into the application database.
- According to Metabase, the company has confirmed active exploitation, making this a patching priority for self-hosted operators.
- Fixed releases include x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5.
- Cloud customers do not need to take the same upgrade step because Metabase says their instances are already patched.
Metabase Confirms Active Exploitation
The vendor says the attack involved an unknown zero-day vulnerability in versions 1.58 and above. Once an attacker gains access, they may be able to obtain administrator access, alter application configuration, steal stored credentials for connected databases, read accessible data and export it.
The maintainer’s GitHub advisory gives the issue a CVSS score of 10.0 and says it requires no privileges or user interaction. Those details describe the technical severity; they do not establish that every exposed instance has been compromised.
Security update available for Metabase – Please upgrade now https://t.co/w48rtnswSk
— Metabase (@metabase) August 6, 2026
What Self-Hosted Teams Should Do?
Metabase’s advice is direct: upgrade to the patched point release that corresponds to the major version in use. Its public advisory lists affected ranges beginning at x.58.0 and ending below the fixed releases for each supported branch. Teams should confirm their current version before applying an update, then follow their own change-control and backup procedures.
For operators who cannot update immediately, the advisory identifies blocking the `/api/session/reset_password` endpoint as a temporary workaround. A workaround is not a substitute for a patch; Metabase says the fixed point release is the remediation.
The company also advises instances with that endpoint publicly accessible to review sessions, API keys, administrator accounts, connected database credentials and activity logs after upgrading. Those are vendor provided incident response steps, not evidence of compromise in a particular deployment.
Framework Discussion Illustrates the Wider Exposure Question
A thread on Framework’s community forum contains user discussion of a notice describing a limited customer-information breach. The forum is a user generated source, so its claims should not be treated as an independent technical confirmation of Metabase’s vulnerability. It does, however, show why customers of organisations that connect business-intelligence tools to operational data may ask what information those tools can access.
One post quotes a Framework notice saying the company was evaluating data shared with business-intelligence platforms and scoping access to the columns required for analysis. Framework has not published a statement in the supplied sources that would allow SQ Magazine to quantify affected people or data categories, so this report does not make those claims.
For broader context, 78% of organisations worldwide reported at least one cybersecurity incident in the past 12 months. That does not measure exposure from this flaw, but it explains why patch ownership matters.
Global cloud computing value is projected at about $947.3 billion in 2026. That scale is context for the Cloud-versus-self-hosted distinction, not an estimate of Metabase’s market or the incident’s impact.
Organisations generate roughly 402.74 million terabytes of data each day worldwide. That is broader industry context, not a measure of data exposed through Metabase.
SQ Magazine’s Takeaway
The practical split is clear: Metabase Cloud customers have the vendor’s statement that their instances are patched, while self-hosted teams own the upgrade decision and need to check the release branch they run. The confirmation of active exploitation makes delaying that check difficult to justify.
Administrators should use Metabase’s advisory as the authoritative checklist, apply the matching fixed point release, and investigate their environment in line with the vendor’s guidance if the exposed endpoint was public. The community reports around Framework add context, but they are not a replacement for a company incident notice or a forensic finding.
