Executive brief
Metabase is a business intelligence tool used to visualize and analyze data. A security flaw allows an authorized administrator to execute malicious code on the server by providing specially crafted database connection settings. This could lead to a full takeover of the server, unauthorized access to sensitive business data, or disruption of services.
Technical details
A code injection vulnerability exists in Metabase due to improper validation of H2 connection properties during database registration. An authenticated user with administrative privileges can exploit a specific database-creation code path to provide malicious connection strings that trigger arbitrary Java code execution on the underlying server. The vulnerability stems from the application's failure to sanitize or restrict unsafe H2 properties that allow for remote class loading or direct code execution. This issue is tracked as CVE-2026-59826 and has been patched in versions 1.58.15.1, 1.59.12, 1.60.6.3 (and 1.60.7), and 1.61.2.
Affected products
- Metabase Metabase 1.55.0 to 1.58.15.0, 1.59.0 to 1.59.11, 1.60.0 to 1.60.6.2, 1.61.0 to 1.61.1
Timeline
- 2026-06-30: advisory: GitHub Security Advisory GHSA-8wx2-rxp2-4x35 published
- 2026-07-09: disclosed: CVE-2026-59826 published to NVD
References
- https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01
- https://github.com/metabase/metabase/releases/tag/v0.58.15.1
- https://github.com/metabase/metabase/releases/tag/v0.59.12
- https://github.com/metabase/metabase/releases/tag/v0.60.6.3
- https://github.com/metabase/metabase/releases/tag/v0.61.2
- https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35