Skip to content
OpenAdvisories
Critical · 9.9 Public exploit CVE-2026-59827 EUVD-2026-42659

Metabase: Unsafe Deserialization of H2 Query Results

Published Jul 9, 2026 · Updated Jul 9, 2026 · Assigned by GitHub_M

Vendor: metabase Product: metabase

Description

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.

Affected products

VendorProductAffectedFixed
metabase metabase >= 1.58.0, < 1.58.15, >= 1.59.0, < 1.59.12, >= 1.60.0, < 1.60.6.3, >= 1.61.0, < 1.61.1.4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 4 repositories

  • Gutierre0x80/CVE-2026-59827 ★ 3 · Aug 12, 2026

    Technical analysis and proof of concept for CVE-2026-59827, a critical unsafe Java deserialization vulnerability in Metabase leading to remote code execution.

  • pickl31/CVE-2026-59827 ★ 1 · Jul 23, 2026

    Metabase CVE-2026-59827 Vulnerability Scanner

  • shivammittal2403/cve-2026-59827-metabase-cyber-range ★ 0 · Sep 17, 2026

    Educational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking production Metabase.

  • c0gnit00/CVE-2026-59827 ★ 0 · Jul 15, 2026

    Blog on CVE-2026-59827, Unsafe H2 query ouput deserialization

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References