PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

February 2026 vulnerability: What happened?

metabase.com | blog | #vulnerability | #metabase | #postmortem | #credential-leak | #handlebars | #security-fix
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Metabase postmortem: a crafted Handlebars notification template let an authenticated user extract database credentials via outbound email; fixes lock the template engine down and strip query metadata.
Published
Collected

Related coverage

advisory · metabase.com
August 2026 Security Vulnerability: What happened?
This advisory helps Metabase administrators evaluate impact and complete recommended upgrade procedures.
blog · metabase.com
'Wait, you don't have a semantic layer yet?' AI analytics readiness pulse
We asked 73 data people about AI Analytics: 59% are already using AI with their data, 44% want it all self-hosted, and 31% of poll voters don’t know what a semantic layer is. A small, unscientific snapshot from AI Analytics Week.
blog · metabase.com
We don't use PHP
We don't use PHP at Metabase, and we removed eMudhra-related certificates in a recent update.
blog · metabase.com
As humans write less code: workloads shift from human to agent verification with iterative test suites
How iterative test suites, human intuition, and unified data lineage can help verify agent-generated analytics.
blog · metabase.com
Making pivot tables faster with GROUPING SETS
Pivot tables used to require many queries and a lot of glue code to keep the totals consistent. Using SQL GROUPING SETS, we are now able to query the database for the whole pivot table at once.
blog · metabase.com
The bottleneck moved: how to build a semantic layer for AI Analytics
AI removed the querying bottleneck and created a verification one. Here's the semantic layer that makes AI-generated answers traceable, and how to build it.
Back