August 2026 Summaries

Metabase disclosed a zero-day vulnerability discovered after a Cloud customer reported an API key created outside normal hours on August 3, 2026, with investigation finding that a single IP had used a similar attack sequence against multiple instances. The flaw affected installations running version 0.58 or later and resulted in compromise of fewer than 3% of Metabase Cloud customers before mitigation, along with some publicly accessible open-source and self-hosted deployments. The chained vulnerability began at the password-reset endpoint, where permissive schema validation allowed extra fields, a prior authentication refactor forwarded the full request body, and interactions between the Toucan2 ORM and HoneySQL enabled raw SQL injection through a supplied user ID. Attackers could use this access to create sessions for the initial administrator account, inspect data, and create API keys for bulk downloads. Metabase blocked the originating network activity, deployed Cloud patches, released patched versions on August 6, engaged an external incident-response firm, and added fixes for related vulnerabilities. The company also introduced broader hardening measures, beginning with version 63.13, including stricter validation, protections against SQL injection and session creation, improved permission and cache isolation, and defenses involving query processing, SSRF, sandboxes, and database connection impersonation.

Metabase is hosting three free live AI Analytics Week sessions from August 25–27 at 12 p.m. ET, focused on helping data teams adopt AI while maintaining answer accuracy, governance, ownership, and control. Attendees can take a five-question readiness quiz to identify the most relevant session, and recordings will be available afterward. The August 25 session covers semantic layers and validating AI-generated data answers in Metabase, the August 26 session addresses secure and governed deployment options such as self-hosting, bring-your-own-model configurations, zero data movement, access controls, token limits, and auditing, and the August 27 session explores dashboards-as-code, Metabase CLI, remote sync, YAML generation, and agentic development workflows. The event also promotes Metabase’s OUTER JOIN conference in Denver in October, with session attendees receiving a discount code.

Model Context Protocol (MCP) is an open standard that enables large language models to securely interact with external data sources through reusable, governed integrations rather than custom-built connections. The guide explains how Metabase can expose an MCP server through an active AI connection, allowing compatible LLM clients to inspect schemas, query connected databases, access saved analytics content, and return visualizations while inheriting each user’s existing permissions. Metabase’s Data Studio semantic layer, including curated models, standardized metrics, glossaries, and dependencies, helps ensure that natural-language questions use agreed business definitions instead of ambiguous raw-table calculations. Setup requires a running Metabase instance, administrative access, connected data sources, and, for self-hosted AI features, an Anthropic API key; users then configure AI settings and connect an MCP client through local or remote transport. A sample workflow shows an LLM translating a request for monthly revenue into a governed query and line chart, using a shared Total Revenue metric. The discussion compares Metabase with Power BI, Superset, and Lightdash, highlighting Metabase’s built-in MCP support, broad connector coverage, and accessible semantic modeling, while recommending precise prompts, explicit date ranges and visualization requests, incremental investigation, reuse of existing analytics logic, and caching for reliable, efficient results.

Metabase has released hardened versions following a security update and a vulnerability identified the previous week, incorporating API protections and fixes for related issues uncovered through internal research and input from DOS, Ophion Security, and Anthropic. Users are strongly urged to upgrade immediately to the latest safe point release within their current major version, with minimum supported releases ranging from v0.58.28 to v0.63.10. The company is postponing its next feature release in favor of weekly minor updates focused on security and observability while internal and external investigations continue. Metabase also states that it will continue investing in first-party security research and collaboration with external researchers, and plans to share further relevant findings as they become available.

Metabase disclosed a security incident involving a previously unknown vulnerability affecting self-hosted versions 0.58 and later, while Metabase Cloud instances have already been patched. The flaw could allow an attacker to exploit the password-reset endpoint to inject SQL into the Metabase application database, potentially gaining administrator access, altering configuration, obtaining database credentials, accessing connected data, and exporting it. Users are advised to immediately upgrade to the latest safe point release for their version, revoke active sessions, review API keys and administrator accounts, rotate connected-database credentials, and inspect warehouse logs and Metabase activity for unauthorized behavior. A likely compromise is indicated by a failed POST request to `/api/session/reset_password` followed by a successful GET request to `/api/user/current`; organizations unable to update immediately should temporarily block the password-reset endpoint.

Metabase disclosed a security incident involving a previously unknown vulnerability affecting self-hosted versions 0.58 and later, which allowed attackers to exploit the public password-reset endpoint, inject arbitrary SQL into the application database, and potentially obtain administrator access. Such access could enable configuration changes, theft of stored database credentials, access to connected data, and data exports. Metabase Cloud instances have already been patched, while self-hosted users are urged to upgrade immediately to the latest safe point release for their major version, with versions earlier than 0.58 unaffected. Organizations whose password-reset endpoint was publicly accessible should revoke user sessions, inspect API keys and administrator accounts, rotate connected-database credentials, and review warehouse, activity, and query logs for suspicious activity. A likely compromise is indicated by a failed POST request to the password-reset endpoint followed by a successful GET request to the current-user endpoint, and users unable to upgrade promptly are advised to temporarily block the affected endpoint.