CERT-FR advisory: multiple vulnerabilities in Metabase before 0.64.3.4 / 1.64.3.4
CERT-FR published advisory CERTFR-2026-AVI-1403 on 28 October 2026 reporting multiple vulnerabilities in Metabase. Affected are Metabase Pro and Enterprise versions prior to 1.64.3.4 and Metabase versions prior to 0.64.3.4. The vendor did not specify the impact; CERT-FR states the flaws allow an attacker to cause an unspecified security issue. The issues are documented in Metabase security bulletin GHSA-v44v-x8x4-mvcw of 28 October 2026. No CVE identifiers, CVSS scores, IOCs or exploitation in the wild are mentioned.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1403 reports multiple vulnerabilities in Metabase. Affected are Metabase versions before 0.64.3.4 and Metabase Pro and Enterprise versions before 1.64.3.4, and the fixes are in those releases. The vendor did not specify the impact, so the flaw types, the required access and what an attacker gains are not stated. No CVE identifiers or CVSS scores are given.
Como funciona
The articles do not describe how the vulnerable process works. CERT-FR says only that an attacker could cause an unspecified security issue, and gives no component, input or step where things go wrong.
Por que é vulnerável
The root cause is not stated. The CERT-FR advisory defers to the vendor bulletin, and the vendor's impact is described as unspecified. Nothing is said about why the flaws went unnoticed or what the fix changes in the code.
Como foi descoberta
The articles do not say who found the flaws or how. They only say that the vendor published security bulletin GHSA-v44v-x8x4-mvcw on 28 October 2026, and that CERT-FR issued its advisory the same day pointing to it for the fixes. No exploitation in the wild is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 13:22.
Detalhes técnicos
- Affected: Metabase < 0.64.3.4, Metabase Pro/Enterprise < 1.64.3.4.
- Impact: unspecified by the vendor.
Remediação
- Apply the fixes referenced in Metabase advisory GHSA-v44v-x8x4-mvcw.
Linha do tempo
-
CERT-FR advisory: multiple vulnerabilities in Metabase before 0.64.3.4 / 1.64.3.4
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1403 on 28 October 2026 reporting multiple vulnerabilities in Metabase. Affected are Metabase Pro and Enterprise versions prior to 1.64.3.4 and Metabase versions prior to 0.64.3.4. The vendor did not specify the impact; CERT-FR states the flaws allow an attacker to cause an unspecified security issue. The issues are documented in Metabase security bulletin GHSA-v44v-x8x4-mvcw of 28 October 2026. No CVE identifiers, CVSS scores, IOCs or exploitation in the wild are mentioned.
Technical Details
- Affected: Metabase < 0.64.3.4, Metabase Pro/Enterprise < 1.64.3.4.
- Impact: unspecified by the vendor.
Remediation
- Apply the fixes referenced in Metabase advisory GHSA-v44v-x8x4-mvcw.