--- title: "Security update available for Metabase - Please upgrade now" url: https://daily.dev/posts/security-update-available-for-metabase---please-upgrade-now-m1ith081a source_url: https://www.metabase.com/blog/security-update type: article source: "Metabase" published: 2026-08-06T21:03:22.679Z updated: 2026-08-12T02:45:25.297Z tags: ["security", "sql", "bi"] reading_time: 2 upvotes: 7 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security update available for Metabase - Please upgrade now **[Metabase](https://daily.dev/sources/metabase)** · 2 min read · 7 upvotes · 0 comments ## Summary A critical 0-day security vulnerability has been discovered in Metabase versions 1.58 and above, actively exploited against Metabase Cloud. The vulnerability allows attackers to inject arbitrary SQL against the Metabase application database, potentially granting administrator access, stealing stored database credentials, and exporting data. Metabase Cloud instances are already patched. Self-hosted users must immediately upgrade to the minimum safe release for their version branch (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5). The attack pattern involves a POST to /api/session/reset_password returning 400 followed by a GET to /api/user/current returning 200. If the reset_password endpoint is publicly accessible, users should also run TRUNCATE TABLE core_session after upgrading. As a temporary workaround, blocking the /api/session/reset_password endpoint is recommended if immediate upgrade is not possible. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What versions of Metabase are affected by the critical 0-day SQL injection vulnerability? Metabase versions 1.58 and above are vulnerable. The minimum safe releases are: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. Versions below 58 are not affected. Metabase Cloud instances were patched automatically. The vulnerability allows arbitrary SQL injection against the application database, potentially granting attacker administrator access and the ability to steal stored database credentials. _Teams running self-hosted Metabase can track patch advisories like this one on daily.dev before they become incidents._ ### How can I tell if my self-hosted Metabase instance was compromised by the reset_password exploit? Look in your application logs or Metabase server ingress logs for this pattern: a POST to /api/session/reset_password returning a 400 status code, immediately followed by a GET to /api/user/current returning a 200 status code. If that sequence appears, your instance is likely compromised. After upgrading, if the reset_password endpoint was publicly accessible, run TRUNCATE TABLE core_session to invalidate all sessions. _Security incidents in self-hosted analytics tools surface fast on daily.dev — worth watching if you manage your own Metabase._ ## Similar posts on daily.dev - [Security update available for Metabase - Please upgrade now](https://daily.dev/posts/security-update-available-for-metabase---please-upgrade-now-tsxl6886g) · Metabase · 6 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#bi](https://daily.dev/tags/bi) [View this post on daily.dev](https://daily.dev/posts/security-update-available-for-metabase---please-upgrade-now-m1ith081a)