Log in Start free

Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-59827Metabase: Unsafe Deserialization of H2 Query Results

Critical 9.9

In plain English

A critical-severity unsafe deserialization in metabase from metabase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)3.8%top 10.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.

Affected products (as reported)

VendorProductVersions
metabase metabase >= 1.58.0, < 1.58.15>= 1.59.0, < 1.59.12>= 1.60.0, < 1.60.6.3>= 1.61.0, < 1.61.1.4

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References