Log in Start free

Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-59826Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Critical 9.1

In plain English

A critical-severity code injection in metabase from metabase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.0%top 36.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.

Affected products (as reported)

VendorProductVersions
metabase metabase >= 1.55.0, < 1.58.15.1>= 1.59.0, < 1.59.12>= 1.60.0, < 1.60.6.3>= 1.61.0, < 1.61.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References