117,240 Metabase Fingerprints: A Dashboard Is a Doorway to the Warehouse

Business intelligence tools are built to answer questions, and answering questions requires a connection to the database that holds the answers. That connection is the part worth thinking about.
ZoomEye measurements collected on 28 October 2026 show 117,240 assets matching app="Metabase" and 108,055 matching title="Metabase". The two figures are close, which suggests the fingerprint and the page title agree on most indexed assets, and that the deployments are largely uniform in how they present themselves.

What the connection carries

A BI platform connects to a data warehouse with a database user. The permissions on that user determine what the dashboards can see, and in practice those permissions are set generously because a dashboard that returns an error is a support ticket.
The result is a service account that can read more than any single dashboard displays. It can read the tables behind every dashboard, including the ones that were built for an audit, a finance review or a one-off investigation and then left in place.
That distinction is the reason a BI instance is not equivalent to a public web application. Compromising a marketing site yields the marketing site. Compromising a BI platform yields a query interface into the warehouse, with the credentials already configured and the schema already mapped.

Where the exposure comes from

The deployment pattern explains the count. Metabase is easy to run, which is a genuine virtue and also the reason it ends up on a virtual machine that somebody stood up to answer a question quickly. That machine gets a public address because the analyst working from home needs to reach it, and the security review that a production service would receive does not happen.
Metabase's own documentation covers authentication, user groups and permissions, and the platform supports connecting an external identity provider. The gap between what is documented and what is deployed is the ordinary gap: features that require configuration are configured only when somebody decides the requirement applies.

The questions to ask

Start with how users are created. An instance that allows open sign-up hands a query interface to anyone who finds it; an instance that requires an administrator to invite users is a different system with the same software.
Then look at the database connections and the credentials behind each one. A read-only user scoped to a schema is the correct shape for most analytics work. A connection using an administrative account is common and indefensible, and it is discovered by reading the connection configuration rather than by scanning.
Review what the internal collections expose. Saved questions carry SQL, and saved SQL carries table and column names. An authenticated user with view permission on a collection learns the schema without running a query.
Finally, check whether the instance is reachable from the internet. A BI tool used by a known set of staff can sit behind an identity-aware proxy, which is a smaller change than it sounds and removes the entire public surface from consideration.

The number and the habit

117,240 is a count of indexed assets, and it is best used as a reminder of how much analytical infrastructure has accumulated outside the systems that receive formal change control. Nothing in the figure says that any of those instances are misconfigured.
The habit worth building is narrower. Every BI connection is a grant of read access to a data store, and grants accumulate. An organisation that reviewed its warehouse credentials the way it reviews its firewall rules would find connections created for projects that ended years ago, still holding permissions that were sized for a question nobody asks anymore.
That review does not require a scanner. It requires the list, which the platform already maintains.

References

• Metabase documentation: https://www.metabase.com/docs/latest/
• ZoomEye query app="Metabase", 2026-10-28: https://www.zoomeye.ai/searchResult?q=YXBwPSJNZXRhYmFzZSI%3D Measurement notes: counts were collected on 28 October 2026 through the ZoomEye SDK. They describe indexed assets and do not indicate authentication settings, database permissions or data exposure.