We don't use PHP

The recent run of security disclosures doesn’t impact Metabase. We don’t use PHP, we’ve already removed the compromised eMudhra certificate authority, and none of the affected npm packages are in our dependencies.

In May, we wrote about the strip-mining era of open source security. We anticipated that things would get worse, and we improved our internal security practices, policies, and scanning accordingly.

No exposure to PHP

We don’t use PHP in any part of our stack, so the PHP vulnerabilities don’t affect us. No action is required on your part.

eMudhra intermediate certificate compromise

In response to the eMudhra certificate issue, we released an update that removes the emSign ECC Root CA (operated by eMudhra) from the list of trusted certificate authorities. This change is available in Metabase versions 64.3.4, 63.21.1, and 58.37.1.

If you’re using Metabase Cloud, your instance has already been updated to the latest version. If you’re self-hosted, upgrade to one of those versions as soon as possible.

We’re monitoring our dependencies

We continue to carefully monitor our Node.js and Java dependencies. If you are a self-hosted Pro or Enterprise customer, we will notify you through the Security Center about any vulnerabilities we find. Open-source and air-gapped users can follow our blog for security updates.

What you can do

• Self-host if you want control: you can run Metabase on your own servers. You can air-gap it too, so it has no path to the public internet.
• Keep Metabase up to date: If you self-host Metabase, upgrade when we ship security fixes. If you’re a Metabase Cloud customer, we’ll keep your instances up to date and secure.
• Lock down your instance: follow our best practices to secure your self-hosted Metabase instance.
• Stay in the loop: Follow our blog for security updates and best practices.