CVE-2026-59827: Metabase: Unsafe Deserialization of H2 Query Results
Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
metabase/metabaseto a version that resolves this vulnerability.Fixed in 1.58.15 - Upgrade
Upgrade
metabase/metabaseto a version that resolves this vulnerability.Fixed in 1.59.12 - Upgrade
Upgrade
metabase/metabaseto a version that resolves this vulnerability.Fixed in 1.60.6.3 - Upgrade
Upgrade
metabase/metabaseto a version that resolves this vulnerability.Fixed in 1.61.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59827?
CVE-2026-59827 is rated as critical with a severity score of 9.9.
How do I fix CVE-2026-59827?
To fix CVE-2026-59827, upgrade Metabase to versions 1.58.15, 1.59.12, 1.60.6.3, or 1.61.1.4.
What systems are affected by CVE-2026-59827?
CVE-2026-59827 affects Metabase instances that utilize an H2 database connection.
What type of vulnerability is CVE-2026-59827?
CVE-2026-59827 is classified as an unsafe deserialization vulnerability.
What are the potential impacts of CVE-2026-59827?
The potential impacts of CVE-2026-59827 include arbitrary code execution and data exposure.