Comment on Tell HN: Upgrade your Metabase installationparentComments−JJJollyjim3yPresumably the metabase instance also has credentials to access some databases, some of which may be have enough privileges to also get RCE on the database machines (as well as messing with the data they hold).−Dachande6633yWe issue separate read-only credentials for database access fortunately. Still doesn't remove the risk of all the data been exfiltrated though.
Comments
Presumably the metabase instance also has credentials to access some databases, some of which may be have enough privileges to also get RCE on the database machines (as well as messing with the data they hold).
We issue separate read-only credentials for database access fortunately. Still doesn't remove the risk of all the data been exfiltrated though.