CVE-2026-59827
CWE-502Published: July 9, 2026· Updated: Jul 13, 2026
Official Description
Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
Risk Analysis
Metabase is vulnerable to a critical deserialization flaw in instances using an H2 database connection, including the default sample database. Prior to versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, authenticated users can execute arbitrary Java code on the Metabase server by running native H2 queries that deserialize arbitrary Java objects. This vulnerability has a CVSSv3.1 score of 9.9, indicating maximum severity.
No public exploit is currently known for this vulnerability. The flaw requires authentication but is remotely exploitable, making it a high-risk target for authenticated attackers.
Upgrade Metabase to versions 1.58.15, 1.59.12, 1.60.6.3, or 1.61.1.4 or later to mitigate this deserialization vulnerability. Restrict database access to only trusted users and ensure that deserialization of untrusted data is prevented.
Technical Analysis
CVE-2026-59827 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.
From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (6)
Quick Facts
Related CVEs (CWE-502)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-59827 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts