Metabase Patches Vulnerability Exploited as Zero-Day
Source SecurityWeek
Rated High by Threat Radar from the SecurityWeek text
Data as of 10 Aug 2026, 21:20 UTC
What to do
AI-suggested
Metabase has released official patches for versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5 that address this vulnerability. Metabase Cloud instances have already been updated and patched by the vendor. Self-hosted users should apply these patches immediately. Where patching is not possible, users should block the /api/session/reset_password endpoint to mitigate risk temporarily. If compromise is suspected, users should revoke all active user sessions, review and delete unrecognized API keys, audit administrative accounts, rotate credentials for all connected databases, and review logs for suspicious activity, particularly the specified API call patterns.
Description
The security defect allows unauthenticated, remote attackers to gain administrative access to Metabase instances. The post Metabase Patches Vulnerability Exploited as Zero-Day appeared first on SecurityWeek .