CVE-2026-59826
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Metabase, an open-source business intelligence tool, contains a vulnerability allowing an authenticated administrator to execute arbitrary Java code on the server by registering a crafted H2 database connection. The issue affects versions from 1.55.0 up to 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
Risk Assessment
An attacker with admin privileges can fully compromise the Metabase server, leading to data breaches, exposure of sensitive business data, and potential lateral movement within the internal network.
Recommendation
Immediately upgrade Metabase to version 1.58.15.1, 1.59.12, 1.60.6.3, or 1.61.2. Restrict administrator privileges to the minimum necessary.
Other vulnerabilities in Metabase
See all- CVE-2026-72899Critical
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
- CVE-2026-72898CriticalActively exploited
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
- CVE-2026-50148Critical
A vulnerability in Metabase allows a user with permission to add or edit database connections to achieve remote code execution on the Metabase server. It exploits a flaw in the Snowflake JDBC driver that can write arbitrary files anywhere on the host, including replacing Metabase's own database driver files that later execute inside the Metabase process.
- CVE-2026-59827Critical
Metabase prior to versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4 deserializes arbitrary Java objects returned in OTHER type columns from H2 native queries without validation. An authenticated user able to run native H2 queries can execute code on the Metabase server.
- CVE-2026-86116Medium
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
- CVE-2026-72900Medium
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
- CVE-2026-50147High
Metabase from version 1.57.0 to 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4 contains a vulnerability that allows an attacker with access to database connection configuration to read arbitrary files from the Metabase server's filesystem. By adding unsafe JDBC parameters to a MySQL or MariaDB connection, the driver can read files from the Metabase host and expose their contents through queries or validation error messages.
Original NVD description (English source)
Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.