Security update available for Metabase - Please upgrade now

If you are an active Metabase user, we have important information to share about a recent security incident.

We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability.

If you are a Metabase Cloud customer, your instance is already upgraded and patched against this vulnerability.

If you are self-hosting Metabase, your instance of Metabase may be vulnerable. After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data.

For more information, see the security advisory.

We recommend you immediately upgrade to the latest point release of the version you are running and take the following steps.

Immediate steps to take

If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible then please do the following after you upgrade:

• revoke all active user sessions by accessing the Metabase Application Database and deleting all rows in the core_session table
• review your API keys and delete any unrecognized keys
• review administrator accounts for any unexpected changes
• rotate credentials for any of the connected databases
• review data warehouse logs for any sign of unauthorized access
• review Metabase activity and query history for unexpected or unauthorized activity

Attack pattern

The pattern of attack looks like the following:

• call to POST /api/session/reset_password with a 400 status code followed by
• call to GET /api/user/current with a 200 status code

If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.

Upgrade instructions

See the list of versions below and find the latest point version for the Metabase version you’re running. If you’re running a point version below that version, you are still vulnerable and should upgrade.

For example, if you are running 0.58.6, you should upgrade to 0.58.24 release or later. If you’re running a version of Metabase below version 58, you are not vulnerable.. You can find your current version by clicking on the “gear” or “grid” icon in the upper right and selecting “About Metabase” or “Help > About Metabase”, depending on your version.

Minimum safe releases for each Metabase version

The downloads below include the minimum safe release for each Metabase version.

63

0.63.5

• Docker image: metabase/metabase:v0.63.5
• Download the JAR here: https://downloads.metabase.com/v0.63.5/metabase.jar

62

0.62.9

• Docker image: metabase/metabase:v0.62.9
• Download the JAR here: https://downloads.metabase.com/v0.62.9/metabase.jar

61

0.61.11

• Docker image: metabase/metabase:v0.61.11
• Download the JAR here: https://downloads.metabase.com/v0.61.11/metabase.jar

60

0.60.17

• Docker image: metabase/metabase:v0.60.17
• Download the JAR here: https://downloads.metabase.com/v0.60.17/metabase.jar

59

0.59.21

• Docker image: metabase/metabase:v0.59.21
• Download the JAR here: https://downloads.metabase.com/v0.59.21/metabase.jar

58

0.58.24

• Docker image: metabase/metabase:v0.58.24
• Download the JAR here: https://downloads.metabase.com/v0.58.24/metabase.jar

Workaround: temporarily block the affected endpoint

If you are unable to upgrade ASAP, as a temporary workaround, block the /api/session/reset_password endpoint.