Junglewise Threat Intelligence

CVE-2026-59827: Metabase unsafe deserialization in H2 native query results

CVE-2026-59827 · Severity: critical · CVSS 9.9 · Published 2026-07-09

Executive brief

Metabase is a business intelligence tool used to visualize and analyze data. A security vulnerability exists where the application fails to properly validate data returned from certain database queries. An attacker with basic user permissions could exploit this to run unauthorized commands on the server, potentially leading to a full system takeover and theft of sensitive business data.

Technical details

A deserialization vulnerability (CWE-502) exists in Metabase's handling of H2 database query results. When processing native queries against an H2 data source, Metabase does not validate the type of values returned in result columns. Specifically, H2 columns of type 'OTHER' can contain arbitrary serialized Java objects which Metabase's JDBC result handling deserializes without type checking or filtering. An authenticated attacker with permissions to run native H2 queries can craft a malicious query to achieve remote code execution (RCE) on the Metabase server. This affects instances with the default sample database enabled. The issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.

Affected products

  • Metabase Metabase >= 1.58.0, < 1.58.15; >= 1.59.0, < 1.59.12; >= 1.60.0, < 1.60.6.3; >= 1.61.0, < 1.61.1.4

Timeline

  • 2026-06-30: advisory: GitHub Security Advisory GHSA-w95f-x9v9-wv36 published
  • 2026-07-09: disclosed: CVE-2026-59827 published to NVD

References

Related threats