# CVE-2026-59826: Metabase code execution via crafted H2 database connection properties

Source: https://junglewise.ai/threats/cve-2026-59826-metabase-code-execution-via-crafted-h2-database-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-59826 · Severity: critical · CVSS 9.1 · Published 2026-07-09

Metabase is a business intelligence tool used to visualize and analyze data. A security flaw allows an authorized administrator to execute malicious code on the server by providing specially crafted database connection settings. This could lead to a full takeover of the server, unauthorized access to sensitive business data, or disruption of services.

Technologies: [Metabase](https://junglewise.ai/threats/technologies/metabase). Vendors: [Metabase](https://junglewise.ai/threats/vendors/metabase).

## Quick answers

**Is CVE-2026-59826 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59826 being exploited in the wild.

**How severe is CVE-2026-59826?** Critical severity, with a CVSS score of 9.1, published 9 July 2026.

**Which products and versions are affected?** Metabase 1.55.0 to 1.58.15.0, 1.59.0 to 1.59.11, 1.60.0 to 1.60.6.2, 1.61.0 to 1.61.1.

**Is there a fix for CVE-2026-59826?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59826 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59826?** Check whether you run Metabase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in Metabase due to improper validation of H2 connection properties during database registration. An authenticated user with administrative privileges can exploit a specific database-creation code path to provide malicious connection strings that trigger arbitrary Java code execution on the underlying server. The vulnerability stems from the application's failure to sanitize or restrict unsafe H2 properties that allow for remote class loading or direct code execution. This issue is tracked as CVE-2026-59826 and has been patched in versions 1.58.15.1, 1.59.12, 1.60.6.3 (and 1.60.7), and 1.61.2.

## Affected products

- Metabase Metabase 1.55.0 to 1.58.15.0, 1.59.0 to 1.59.11, 1.60.0 to 1.60.6.2, 1.61.0 to 1.61.1

## Timeline

- 2026-06-30: advisory: GitHub Security Advisory GHSA-8wx2-rxp2-4x35 published
- 2026-07-09: disclosed: CVE-2026-59826 published to NVD

## References

- [https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01](https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01)
- [https://github.com/metabase/metabase/releases/tag/v0.58.15.1](https://github.com/metabase/metabase/releases/tag/v0.58.15.1)
- [https://github.com/metabase/metabase/releases/tag/v0.59.12](https://github.com/metabase/metabase/releases/tag/v0.59.12)
- [https://github.com/metabase/metabase/releases/tag/v0.60.6.3](https://github.com/metabase/metabase/releases/tag/v0.60.6.3)
- [https://github.com/metabase/metabase/releases/tag/v0.61.2](https://github.com/metabase/metabase/releases/tag/v0.61.2)
- [https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35](https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35)

## Related threats

- [Metabase unrestricted H2 functions in native queries](https://junglewise.ai/threats/cve-2026-103928-metabase-is-an-open-source-business-intelligence-and-analytics)
- [Metabase GeoJSON SSRF via 0.0.0.0 address bypass](https://junglewise.ai/threats/cve-2026-92813-metabase-geojson-ssrf-via-0-0-0-0-address-bypass)
- [Metabase glossary API missing authorization checks](https://junglewise.ai/threats/cve-2026-86116-metabase-glossary-api-missing-authorization-checks)
- [Metabase information disclosure via native SQL queries](https://junglewise.ai/threats/cve-2026-72900-metabase-information-disclosure-via-native-sql-queries)
- [Metabase SQL injection in publicly shared dashboards](https://junglewise.ai/threats/cve-2026-72899-metabase-sql-injection-in-publicly-shared-dashboards)