March 2026 Summaries

Metabase has introduced the Metabase Data Studio, a new feature designed to help teams manage and streamline their analytics processes as they scale. This platform allows users to shape data into analytics-ready datasets, define reusable metrics and segments, and manage their data without the need for additional tools or workflow changes. Key features of Data Studio include a Library for curated analytics content, a Data Structure tool for adding table metadata, a Glossary for business terms, a Dependency Graph for visualizing content connections, and Dependency Diagnostics for identifying broken dependencies. Additionally, Transforms enable users to manipulate data within Metabase and reuse processed data for new queries. These tools are available in both open-source and paid editions, making data curation accessible to everyone while providing advanced features for professional and enterprise users. Data Studio is part of a broader release in Metabase version 59 and aims to address challenges faced by users dealing with multiple data sources or a large number of tables, providing solutions for clarity, correctness, and performance.

A vulnerability in Metabase's notification API, discovered by security researcher Sho Odagiri, allowed authenticated users to create notification templates that could extract and email database connection details, including credentials. The issue arose from the introduction of Handlebars templates for email content and metadata objects in query results, which were not adequately restricted, allowing access to sensitive information. Metabase addressed this by locking down the Handlebars template engine and removing method resolvers that enabled arbitrary Java method invocations, as well as stripping metadata from query results. All Metabase Cloud instances have been updated to eliminate the vulnerability, and self-hosted users are urged to upgrade to specific versions or newer. To prevent future risks, Metabase is enhancing logging and securing credential access paths. There is no evidence that the vulnerability was exploited before the fix, and credit is given to Sho Odagiri for the discovery.