MapTiler incident
On Friday 7th August, we detected that our self-hosted Metabase instance had been compromised via a zero-day vulnerability affecting versions 0.58 and above; we blocked the affected endpoint and pa...
Resolved on August 12, 2026.
On Friday 7th August, we detected that our self-hosted Metabase instance had been compromised via a zero-day vulnerability affecting versions 0.58 and above; we blocked the affected endpoint and patched the instance within ~5 hours. Following a full audit of the exposed data, we confirmed that an unknown attacker gained temporary read access to a limited set of internal tables, with only 139 customer records (containing name, address, and email linked to invoices) actually affected, and no passwords or payment card data exposed. We've rotated all related credentials, notified the affected customers directly, and added further monitoring; see security page link (https://www.maptiler.com/security/) for details.
Update timeline
- investigating Aug 12, 2026, 07:35 AM UTC
On Friday 7th August, we detected that our self-hosted Metabase instance had been compromised via a zero-day vulnerability affecting versions 0.58 and above; we blocked the affected endpoint and patched the instance within ~5 hours. Following a full audit of the exposed data, we confirmed that an unknown attacker gained temporary read access to a limited set of internal tables, with only 139 customer records (containing name, address, and email linked to invoices) actually affected, and no passwords or payment card data exposed. We've rotated all related credentials, notified the affected customers directly, and added further monitoring; see security page link (https://www.maptiler.com/security/) for details.
Your product runs on more than MapTiler
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services