---
id: 6385
title: "February 2026 vulnerability: What happened?"
source_domain: metabase.com
source_url: "https://www.metabase.com/blog/security-vulnerability-postmortem"
published_at: "2026-03-02T12:10:18Z"
tags: ["vulnerability", "metabase", "postmortem", "credential-leak", "handlebars", "security-fix"]
phying_url: "https://phying.com/item/6385"
lang: en
---

# February 2026 vulnerability: What happened?

## Summary

Metabase postmortem: a crafted Handlebars notification template let an authenticated user extract database credentials via outbound email; fixes lock the template engine down and strip query metadata.

## Intelligence Metadata

- **Sources:** metabase.com
- **Published:** 2026-03-02T12:10:18Z
- **Original:** https://www.metabase.com/blog/security-vulnerability-postmortem
- **Phying News:** https://phying.com/item/6385