Security update available for Metabase - Please upgrade now
All posts
Aug 6, 2026 in News ‧<br>2 min read
Security update available for Metabase - Please upgrade now<br>Sameer Al-Sakran
‧ Aug 6, 2026 in News<br>‧ 2 min read
Share this article
Copied to clipboard
If you are an active Metabase user, we have important information to share about a recent security incident.
We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability.
If you are a Metabase Cloud customer, your instance is already upgraded and patched against this vulnerability.
If you are self-hosting Metabase, your instance of Metabase may be vulnerable. After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data.
For more information, see the security advisory.
We recommend you immediately upgrade to the latest point release of the version you are running and take the following steps.
Immediate steps to take
If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible then please do the following after you upgrade:
revoke all active user sessions by accessing the Metabase Application Database and TRUNCATE TABLE core_session
review your API keys and delete any unrecognized keys
review administrator accounts for any unexpected changes
rotate credentials for any of the connected databases
review data warehouse logs for any sign of unauthorized access
review Metabase activity and query history for unexpected or unauthorized activity
Attack pattern
The pattern of attack looks like the following:
call to POST /api/session/reset_password with a 400 status code followed by
call to GET /api/user/current with a 200 status code
If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.
Upgrade instructions
See the list of versions below and find the latest point version for the Metabase version you’re running. If you’re running a point version below that version, you are still vulnerable and should upgrade.
For example, if you are running 0.58.6, you should upgrade to 0.58.24 release or later. If you’re running a version of Metabase below version 58, you are not vulnerable.. You can find your current version by clicking on the “gear” or “grid” icon in the upper right and selecting “About Metabase” or “Help > About Metabase”, depending on your version.
Minimum safe releases for each Metabase version
The downloads below include the minimum safe release for each Metabase version.
63
0.63.5
Docker image: metabase/metabase:v0.63.5
Download the JAR here: https://downloads.metabase.com/v0.63.5/metabase.jar
62
0.62.9
Docker image: metabase/metabase:v0.62.9
Download the JAR here: https://downloads.metabase.com/v0.62.9/metabase.jar
61
0.61.11
Docker image: metabase/metabase:v0.61.11
Download the JAR here: https://downloads.metabase.com/v0.61.11/metabase.jar
60
0.60.17
Docker image: metabase/metabase:v0.60.17
Download the JAR here: https://downloads.metabase.com/v0.60.17/metabase.jar
59
0.59.21
Docker image: metabase/metabase:v0.59.21
Download the JAR here: https://downloads.metabase.com/v0.59.21/metabase.jar
58
0.58.24
Docker image: metabase/metabase:v0.58.24
Download the JAR here: https://downloads.metabase.com/v0.58.24/metabase.jar
Workaround: temporarily block the affected endpoint
If you are unable to upgrade ASAP, as a temporary workaround, block the /api/session/reset_password endpoint.
You might also enjoy
All posts
Jun 10, 2026 in News Introducing the Claude skill for learning Metabase<br>Use Claude to teach you Metabase in a structured way, using your own data.<br>Robert Kosara<br>‧ 2 min read
Jun 2, 2026 in News Metabase + OpenAI Codex<br>Metabase is now available as a plugin in ChatGPT Codex, part of OpenAI's new data analytics launch<br>Vamsi Peri<br>‧ 1 min read
All posts
Subscribe to newsletter
Updates and news from Metabase