GHSA-8wx2-rxp2-4x35: Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Q: Who can exploit this issue?

An authenticated Metabase administrator can exploit it by registering a crafted H2 database connection. The vulnerable code path can result in arbitrary Java code execution on the Metabase server.

Q: Which deployments and versions are affected?

Metabase versions from 1.55.0 through the fixed releases are affected. Upgrade to 1.58.15.1, 1.59.12, 1.60.6.3, or 1.61.2, as appropriate for the release line in use.

Q: What should be prioritized if an immediate upgrade is not possible?

Restrict administrator access because exploitation requires authenticated administrator privileges. In particular, prevent untrusted administrators from creating H2 database connections until the deployment can be upgraded.

Published Jul 9, 2026

Updated

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.

Affected Software

1 affected component

Metabase Metabase>=1.55.0<1.58.15.1, >=1.59.0<1.59.12, >=1.60.0<1.60.6.3, >=1.61.0<1.61.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Metabase to a version that resolves this vulnerability.
Fixed in 1.58.15.1
Upgrade
Upgrade Metabase to a version that resolves this vulnerability.
Fixed in 1.59.12
Upgrade
Upgrade Metabase to a version that resolves this vulnerability.
Fixed in 1.60.6.3
Upgrade
Upgrade Metabase to a version that resolves this vulnerability.
Fixed in 1.61.2

Event History

Jul 9, 2026

CVE Published

via OSV·05:46 PM

Data Sourced

via OSV·05:46 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Metabase administrator can exploit it by registering a crafted H2 database connection. The vulnerable code path can result in arbitrary Java code execution on the Metabase server.

Which deployments and versions are affected?

Metabase versions from 1.55.0 through the fixed releases are affected. Upgrade to 1.58.15.1, 1.59.12, 1.60.6.3, or 1.61.2, as appropriate for the release line in use.

What should be prioritized if an immediate upgrade is not possible?

Restrict administrator access because exploitation requires authenticated administrator privileges. In particular, prevent untrusted administrators from creating H2 database connections until the deployment can be upgraded.

GHSA-8wx2-rxp2-4x35: Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments and versions are affected?

What should be prioritized if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments and versions are affected?

What should be prioritized if an immediate upgrade is not possible?