Is CVE-2026-59826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59826 being exploited in the wild.

How severe is CVE-2026-59826?

Critical severity, with a CVSS score of 9.1, published 9 July 2026.

Which products and versions are affected?

Metabase 1.55.0 to 1.58.15.0, 1.59.0 to 1.59.11, 1.60.0 to 1.60.6.2, 1.61.0 to 1.61.1.

Is there a fix for CVE-2026-59826?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59826 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59826?

Check whether you run Metabase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59826: Metabase code execution via crafted H2 database connection properties

CVE-2026-59826 · Severity: critical · CVSS 9.1 · Published 2026-07-09

Metabase is a business intelligence tool used to visualize and analyze data. A security flaw allows an authorized administrator to execute malicious code on the server by providing specially crafted database connection settings. This could lead to a full takeover of the server, unauthorized access to sensitive business data, or disruption of services.

Technologies: Metabase. Vendors: Metabase.

Quick answers

Is CVE-2026-59826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59826 being exploited in the wild.
How severe is CVE-2026-59826?: Critical severity, with a CVSS score of 9.1, published 9 July 2026.
Which products and versions are affected?: Metabase 1.55.0 to 1.58.15.0, 1.59.0 to 1.59.11, 1.60.0 to 1.60.6.2, 1.61.0 to 1.61.1.
Is there a fix for CVE-2026-59826?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59826 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59826?: Check whether you run Metabase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in Metabase due to improper validation of H2 connection properties during database registration. An authenticated user with administrative privileges can exploit a specific database-creation code path to provide malicious connection strings that trigger arbitrary Java code execution on the underlying server. The vulnerability stems from the application's failure to sanitize or restrict unsafe H2 properties that allow for remote class loading or direct code execution. This issue is tracked as CVE-2026-59826 and has been patched in versions 1.58.15.1, 1.59.12, 1.60.6.3 (and 1.60.7), and 1.61.2.

Affected products

Metabase Metabase 1.55.0 to 1.58.15.0, 1.59.0 to 1.59.11, 1.60.0 to 1.60.6.2, 1.61.0 to 1.61.1

Timeline

2026-06-30: advisory: GitHub Security Advisory GHSA-8wx2-rxp2-4x35 published
2026-07-09: disclosed: CVE-2026-59826 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.