All posts
Oct 27, 2026 in Engineering
The recent run of security disclosures doesn’t impact Metabase. We don’t use PHP, we’ve already removed the compromised eMudhra certificate authority, and none of the affected npm packages are in our dependencies.
In May, we wrote about the strip-mining era of open source security. We anticipated that things would get worse, and we improved our internal security practices, policies, and scanning accordingly.
No exposure to PHP
We don’t use PHP in any part of our stack, so the PHP vulnerabilities don’t affect us. No action is required on your part.
In response to the eMudhra certificate issue, we released an update that removes the emSign ECC Root CA (operated by eMudhra) from the list of trusted certificate authorities. This change is available in Metabase versions 64.3.4, 63.21.1, and 58.37.1.
If you’re using Metabase Cloud, your instance has already been updated to the latest version. If you’re self-hosted, upgrade to one of those versions as soon as possible.
We’re monitoring our dependencies
We continue to carefully monitor our Node.js and Java dependencies. If you are a self-hosted Pro or Enterprise customer, we will notify you through the Security Center about any vulnerabilities we find. Open-source and air-gapped users can follow our blog for security updates.
What you can do
- Self-host if you want control: you can run Metabase on your own servers. You can air-gap it too, so it has no path to the public internet.
- Keep Metabase up to date: If you self-host Metabase, upgrade when we ship security fixes. If you’re a Metabase Cloud customer, we’ll keep your instances up to date and secure.
- Lock down your instance: follow our best practices to secure your self-hosted Metabase instance.
- Stay in the loop: Follow our blog for security updates and best practices.
You might also enjoy
Oct 21, 2026 in Engineering
Making pivot tables faster with GROUPING SETS
Pivot tables used to require many queries and a lot of glue code to keep the totals consistent. Using SQL GROUPING SETS, we are now able to query the database for the whole pivot table at once.
‧ 10 min read
Oct 12, 2026 in Engineering
More, Better, Faster: How we automate Metabase releases
How we went from a manual Metabase release checklist to fully automated daily patch releases with GitHub Actions, reused test builds, and a three-click release UI
‧ 4 min read
