Remediating CVE-2026-66755

Ryan_251 · August 27, 2026, 5:29pm

Hi,

I created an issue for the CVE mentioned in the title, it is something to do with metabase v0.63.14.2 using an out-of-date version of Apache Tika Core. My org and I want to roll out an up-to-date version of Metabase to production but this one CVE blocks the pipeline from deploying it successfully. Our scanner picked it up and it is of high severity. I hope this is the right place to bring it up; can we get an ETA on when the dependency update can be merged to master?

github.com/metabase/metabase

Bump Apache Tika Core from 3.2.3 to 3.3.2 to patch CVE-2026-66755

opened 03:09PM - 26 Aug 26 UTC

rten-work1

Priority:P3

Our org pulled metabase v0.63.14.2 because it included a fix to several curl-dep…endency-related CVEs with critical/high severity, but one blocking 'HIGH' CVE still remains in our vulnerability scan pipeline: [CVE-2026-66755](https://nvd.nist.gov/vuln/detail/CVE-2026-66755). Both our scanner and the NIST entry describe the solution as bumping org.apache.tika_tika-core to 3.3.2. Patching this CVE is necessary to remediate all the remaining high/critical security vulnerabilities in our wrapper Docker instance of metabase. PR already created: https://github.com/metabase/metabase/pull/80665 Please let me know if more information is required. Thanks.

Thanks,

Ryan

dragonsahead · September 8, 2026, 6:59pm

this should get fixed in 64

Ryan_251 · September 9, 2026, 2:41pm

Thanks for the confirmation!

Ryan_251 · September 9, 2026, 7:40pm

Do you have an ETA on when 64 will come out? I cannot find that information anywhere

dragonsahead · September 9, 2026, 7:46pm

we’ll decide that in the next few days

system · September 12, 2026, 7:47pm

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.