CVE-2026-59826
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Metabase, an open-source business intelligence tool, contains a vulnerability allowing an authenticated administrator to execute arbitrary Java code on the server by registering a crafted H2 database connection. The issue affects versions from 1.55.0 up to 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
Risk Assessment
An attacker with admin privileges can fully compromise the Metabase server, leading to data breaches, exposure of sensitive business data, and potential lateral movement within the internal network.
Recommendation
Immediately upgrade Metabase to version 1.58.15.1, 1.59.12, 1.60.6.3, or 1.61.2. Restrict administrator privileges to the minimum necessary.
Original NVD description (English source)
Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.