Metabase (< 0.64.3.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/metabase--0.64.3.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 17:43:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMetabase: Multiple vulnerabilities in Pro, Enterprise, and open-source versionshttps://feed.craftedsignal.io/briefs/2026-10-metabase-vulnerabilities/Wed, 28 Oct 2026 17:43:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-metabase-vulnerabilities/Metabase has released security updates for multiple unspecified vulnerabilities affecting Pro, Enterprise, and open-source editions, requiring an upgrade to version 0.64.3.4 or 1.64.3.4.Multiple vulnerabilities have been identified in Metabase. The vendor has released security patches to address these issues, which were disclosed in GHSA-v44v-x8x4-mvcw. The nature of the vulnerabilities remains undisclosed by the manufacturer. Users must upgrade to versions 0.64.3.4 (open-source) or 1.64.3.4 (Pro/Enterprise) to remediate the potential security risk.

Recommendation

  • Identify all instances of Metabase in the environment and determine if they are running a version prior to 0.64.3.4 or 1.64.3.4.
  • Apply the updates to Metabase, Metabase Pro, and Metabase Enterprise to reach version 0.64.3.4 or 1.64.3.4 immediately.
  • Review the vendor's security advisory GHSA-v44v-x8x4-mvcw for any additional post-patch configuration requirements.
]]>mediumadvisoryvulnerabilitywebserverinformational