Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1096
_____________________________________________________________________

DATE                : 28/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Metabase versions prior to
                                        x.64.3.4.

====================================================================
https://github.com/metabase/metabase/security/advisories/GHSA-v44v-x8x4-mvcw
_____________________________________________________________________
 
Metabase 64 security update
Critical
enthym-aa published GHSA-v44v-x8x4-mvcw

Software
metabase

Affected versions
>= x.64.0, < x.64.3.4

Patched versions
x.64.3.4


Description

Metabase 64 is our security hardening release, with a batch of security
fixes, a reduced attack surface, and more control over your instance. It
is also a Long Term Support (LTS) release.

The release announcement and changelog describe improvements including:

    Additional input validation for APIs and query compilation, covering
values such as filters, date units, regular expressions and type casts.
It strengthens permission checks for referenced models, metrics and
questions.

    Reduced metadata exposure in public and embedded responses, plus
tighter checks around trashed content and tenant-specific endpoints and
subscription recipients.

    Improvements to login-session handling when users are deactivated or
reactivated, plus removal of database secrets from serialization exports.
Supported email-domain restrictions receive additional checks when sending
alerts and subscriptions, where configured.

    Controls for outbound connections, with network-policy settings for
supported warehouse connections, webhooks, map tiles and AI providers. Pro
and Enterprise admins can require two-factor authentication for password
and LDAP sign-ins, with a grace period.

    Optional session-signing and encryption keys are available across
editions. When configured, they help protect application sessions and
supported sensitive values in the application database, including
credentials and notification-recipient details.

If you self-host Metabase, please upgrade to 0.64.3.4 or later
(Open Source), or 1.64.3.4 or later (Pro and Enterprise). Follow our
upgrade guide and review the security best practices checklist.


Acknowledgments

Thank you to the researchers and teams whose reports helped improve
Metabase’s security, in this and earlier releases:

    Migel Tissera - Drost (Trinity Cloud, Inc.).
    Vivek R and Winfunc.
    Lippg.
    Arthur Chan (@arthurscchan), @DavidKorczynski, @AdamKorcz, and
the Anthropic teams.
    Google and Ada Logics.
    Seonggwon Yoon.
    Shubham Raj / Causal Security.
    DOS.
    Claude, Anthropic's AI assistant, and the Anthropic security
team in collaboration with Anthropic Research.
    @hillalee.
    Younghun Ko (@koyokr).
    Xh081iX.
    Arnaud Pascal (Vaadata).
    Scott Pierce.
    Hassan (TechFenix).
    Cure53.
    Lakshmikanthan K (@l3tchupkt).
    Mark Berger.
    Bodhisattva Das (RUDRA Cybersecurity).
    Ophion Security in collaboration with Anthropic.
    hexcraft-labs.
    Yarin Elias (@JellowBeanz26).

Severity
Critical

CVE ID
No known CVE

Weaknesses
No CWEs




=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================