<![CDATA[Requesting an expedited build of v0.63.5]]>Metabase posted a security advisory today about a zero-day vulnerability giving access to admin accounts. Self-hosted users running Metabase 63 prior to 0.63.5 are vulnerable. I went to update to v0.63.5, and see that it isn't available yet on Cloudron. Requesting an expedited build.

]]>https://forum.cloudron.io/topic/15800/requesting-an-expedited-build-of-v0.63.5RSS for NodeMon, 24 Aug 2026 03:34:36 GMTThu, 06 Aug 2026 16:26:10 GMT60<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Mon, 24 Aug 2026 03:32:44 GMT]]>@james Understood. For situations like these, is posting on this public forum still preferred over email to support@ or security@?

]]>https://forum.cloudron.io/post/128458https://forum.cloudron.io/post/128458Mon, 24 Aug 2026 03:32:44 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Tue, 11 Aug 2026 23:44:57 GMT]]>Hello @sparkwise
Please stop creating a new topic each time.
I will merge the topics into each other.

]]>https://forum.cloudron.io/post/128057https://forum.cloudron.io/post/128057Tue, 11 Aug 2026 23:44:57 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Tue, 11 Aug 2026 22:38:35 GMT]]>Same drill as before, but with a new minimum target release...

The downloads below include the minimum safe release for each Metabase version.
 
63
0.63.10
Docker image: metabase/metabase:v0.63.10
Download the JAR here: https://downloads.metabase.com/v0.63.10/metabase.jar

There is not yet a web link documenting this, so I'd recommend reaching out to help@metabase.com if you want independent first-party confirmation on this.

]]>https://forum.cloudron.io/post/128056https://forum.cloudron.io/post/128056Tue, 11 Aug 2026 22:38:35 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Fri, 07 Aug 2026 14:42:07 GMT]]>@sparkwise right exactly, the build was correct, but I forgot the update the manifest with the upstreamVersion .

]]>https://forum.cloudron.io/post/127904https://forum.cloudron.io/post/127904Fri, 07 Aug 2026 14:42:07 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Fri, 07 Aug 2026 14:33:08 GMT]]>In case this is useful, I saw the Cloudron app update as being available yesterday and successfully updated. “About Metabase” (in app) reports 0.63.5 but the Cloudron Info tab still says “Metabase 0.63.2.7”.

]]>https://forum.cloudron.io/post/127902https://forum.cloudron.io/post/127902Fri, 07 Aug 2026 14:33:08 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Fri, 07 Aug 2026 14:07:39 GMT]]>@luckow there was a typo in the manifest. Can you check again?

]]>https://forum.cloudron.io/post/127900https://forum.cloudron.io/post/127900Fri, 07 Aug 2026 14:07:39 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Fri, 07 Aug 2026 13:49:31 GMT]]>https://forum.cloudron.io/post/127858 shows that there is an update to the latest version 0.63.5. However, my instance isn't showing any available update. Is there something wrong with the workflow?

]]>https://forum.cloudron.io/post/127898https://forum.cloudron.io/post/127898Fri, 07 Aug 2026 13:49:31 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Fri, 07 Aug 2026 10:49:39 GMT]]>Here's the security advisories for anyone interested:
https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp
https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59

Interestingly, the GitHub Advisory Database includes links to the patched versions while GitHub Releases do not even show these (as of today). There must be a lot of chaos going on behind the scenes since their cloud offering was also breached and has affected fairly big customers (e.g. Framework): https://community.frame.work/t/framework-data-breach-discussion/83939

This app is a great candidate for the VPN Protection coming with Cloudron 10 😉

]]>https://forum.cloudron.io/post/127884https://forum.cloudron.io/post/127884Fri, 07 Aug 2026 10:49:39 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Thu, 06 Aug 2026 18:54:02 GMT]]>Ha ha ok, I misunderstood 😄 @james it seems https://downloads.metabase.com/v0.63.5/metabase.jar is available , so we may have to create a manual MR .

]]>https://forum.cloudron.io/post/127844https://forum.cloudron.io/post/127844Thu, 06 Aug 2026 18:54:02 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Thu, 06 Aug 2026 18:50:18 GMT]]>@joseph The CEO of Metabase (not my company’s CEO) sent an email out to their email list. I sent a response to help@metabase.com and they replied immediately to confirm. I’d recommend reaching out to them to confirm. I’ll forward the full email to the Cloudron email account.

]]>https://forum.cloudron.io/post/127843https://forum.cloudron.io/post/127843Thu, 06 Aug 2026 18:50:18 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Thu, 06 Aug 2026 18:39:02 GMT]]>I guess the question is how did you know it has a security issue (or how did your CEO know?) https://www.metabase.com/changelog/63 has no info on this release either .

]]>https://forum.cloudron.io/post/127842https://forum.cloudron.io/post/127842Thu, 06 Aug 2026 18:39:02 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Thu, 06 Aug 2026 17:05:18 GMT]]>@luckow Found it here: https://hub.docker.com/r/metabase/metabase/tags?name=v0.63.5

]]>https://forum.cloudron.io/post/127824https://forum.cloudron.io/post/127824Thu, 06 Aug 2026 17:05:18 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Thu, 06 Aug 2026 16:58:45 GMT]]>@luckow I emailed Metabase to ask about the missing release.

Notification email came from company CEO sent out earlier this morning. I tried to upload a PDF of the email but can't upload PDF to this forum.

]]>https://forum.cloudron.io/post/127823https://forum.cloudron.io/post/127823Thu, 06 Aug 2026 16:58:45 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Thu, 06 Aug 2026 16:45:38 GMT]]>mh. this release isn’t available https://github.com/metabase/metabase/releases

please add a link to your source.

]]>https://forum.cloudron.io/post/127822https://forum.cloudron.io/post/127822Thu, 06 Aug 2026 16:45:38 GMT<![CDATA[Reply to Requesting an expedited build of v0.63.5 on Thu, 06 Aug 2026 16:29:50 GMT]]>Until then, the recommended temporary workaround is for users to block the affected endpoint (/api/session/reset_password).

]]>https://forum.cloudron.io/post/127821https://forum.cloudron.io/post/127821Thu, 06 Aug 2026 16:29:50 GMT