Attackers Are Exploiting a Metabase Dashboard Bug Patched in August: A Checklist for Firms That Host Their Own

Metabase is a popular open-source tool for turning a company's data into dashboards and charts. Plenty of small and mid-sized firms run their own copy: an engineering firm tracking project hours, an accounting or financial office charting client data, a nonprofit reporting on programs. On Nov. 4, 2026, Singapore's Cyber Security Agency (CSA) warned that attackers are actively exploiting a critical Metabase bug, CVE-2026-72898, and that "a proof-of-concept exploit is publicly available."

The bug isn't new. Metabase fixed it on Aug. 6, and CISA added it to its exploited list on Aug. 11. Today's warning is a reminder that any self-hosted Metabase that missed the August update is still a target.

What's been reported

The bug. Metabase's security advisory rates it 10 out of 10 and says it "allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance." From there, Metabase says, an attacker "could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data."
How it started. In its Aug. 6 notice, Metabase said its own hosted service, Metabase Cloud, "was attacked by someone utilizing an unknown ('0-day') security vulnerability in versions 1.58 and above." Cloud customers were patched automatically; self-hosted installs were not.
Who's affected. Versions 58 and later are affected, both the free edition (0.x) and the paid edition (1.x). Metabase's minimum safe releases are 58.24, 59.21, 60.17, 61.11, 62.9 and 63.5. Versions below 58 aren't affected.
Exploitation. Metabase's advisory says it "has confirmed active exploitation." CISA's catalog entry lists it as exploited (added Aug. 11). Singapore's CSA said on Nov. 4 that it "has been actively exploited." No business has been named as a victim, and none of these sources says what data, if any, was taken.

Why an engineering, accounting or financial office should care

A dashboard tool is only useful because it's connected to everything: the accounting database, the project management system, the CRM, sometimes the data warehouse. That means Metabase holds the passwords to those systems. Metabase says an attacker who takes over the admin account can steal those stored credentials and read or export anything the connections can reach. For a firm that holds client financials or design files, that's the whole ballgame.

It's also the kind of server someone in the office set up on a spare machine or a cloud account because it was free and easy, and then made reachable from the internet so the partners could check numbers from home. If that's how yours was set up, nobody may have been watching for the August update.

Clear takeaway

If your firm runs its own Metabase, confirm it's on 58.24, 59.21, 60.17, 61.11, 62.9, 63.5 or later today. If it was reachable from the internet before you updated, treat it as possibly compromised: revoke sessions, review admin accounts and API keys, and change the passwords for every connected database.

What to do this week

Find out if you run it. Ask whoever handles reporting, IT or your outside developer whether the firm uses Metabase and whether it's hosted by Metabase (Cloud, already patched) or on your own server or cloud account.
Check the version. In Metabase, click the gear or grid icon in the upper right and choose About Metabase (or Help > About Metabase). If you're on version 58 or later and below the minimum safe release for that version, update now.
Block the endpoint if you can't update today. Metabase's temporary workaround is to block access to /api/session/reset_password at your firewall, reverse proxy or load balancer until you can upgrade.
Check the logs for Metabase's attack pattern. Metabase says a POST /api/session/reset_password request that returns a 400 error, followed by a GET /api/user/current that returns 200, means the instance has likely been compromised.
If it was exposed, clean up after updating. Metabase's steps: revoke all active sessions (delete the rows in the core_session table of the application database), delete API keys you don't recognize, review administrator accounts for unexpected changes, rotate the passwords for every connected database, and review data warehouse logs and Metabase query history for anything unusual.
Take it off the open internet. A dashboard server doesn't need to be reachable by the whole world. Put it behind your VPN or single sign-on so a future bug can't be hit from anywhere.
Give it a read-only account. Connect Metabase to your databases with read-only accounts that can only see what the dashboards need. If it's ever taken over again, the damage stops there.

How Brotherly Technology can help

Brotherly Technology works with engineering firms, accounting and financial offices and nonprofits that rely on tools like Metabase without a full-time IT team to watch them. We can confirm your version and get it updated, check the logs for Metabase's attack pattern, rotate the database passwords it holds, and move the server behind your VPN. If you think someone set up a dashboard server a while ago and you're not sure where it lives, we can find it.