CVE-2026-59827criticalCWE-502

CVE-2026-59827: critical vulnerability in metabase

Metabase: Unsafe Deserialization of H2 Query Results

Published

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.9epss 3.8%
from disclosure to weapon6 days
Published on NVDJul 9
1st PoC+6d
exploitation probability
3.8%top 10% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
metabase · metabase
public PoCs found — 5
exploitdbwww.exploit-db.com/exploits/52680unverifiedgithubgithub.com/Gutierre0x80/CVE-2026-59827★ 3githubgithub.com/pickl31/CVE-2026-59827★ 1githubgithub.com/shivammittal2403/cve-2026-59827-metabase-cyber-range★ 0githubgithub.com/c0gnit00/CVE-2026-59827★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — metabase

In the same product, most dangerous first.

CVE-2021-41277CRITICALGeoJSON URL validation can expose server files and environment variables to unauthorized usersEPSS 97.2%KEVCVE-2022-24853MEDIUMFile system exposure in MetabaseEPSS 2.5%CVE-2023-37470CRITICALMetabase vulnerable to remote code execution via POST /api/setup/validate API endpoint EPSS 1.3%CVE-2022-39361HIGHMetabase vulnerable to Remote Code Execution via H2EPSS 1.1%CVE-2022-24854HIGHDatabase bypassing any permissions in Metabase via SQlite attachEPSS 1.1%CVE-2026-59826CRITICALMetabase: Arbitrary Code Execution via Database Connection Detail BypassEPSS 1.0%
References
https://github.com/metabase/metabase/commit/00f42511fe3bc4385652a2e96862ee6fd7d42cf8https://github.com/metabase/metabase/releases/tag/v0.58.15https://github.com/metabase/metabase/releases/tag/v0.59.12https://github.com/metabase/metabase/releases/tag/v0.60.6.3https://github.com/metabase/metabase/releases/tag/v0.61.1.4https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36