CVE-2026-59826 metabase CVE debrief

Who should care

Administrators and users of Metabase instances, especially those with access to database creation, should be aware of this vulnerability and take immediate action to update their instances to a patched version. Additionally, security teams and vulnerability management teams should review the affected scope and severity to prioritize remediation efforts.

Technical summary

Metabase, an open-source business intelligence tool, had a vulnerability in versions from 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2. The issue allowed authenticated administrators to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server due to a lack of validation of unsafe H2 connection properties. This critical vulnerability, with a CVSS score of 9.1, was fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2. Affected administrators should urgently review and update their instances.

Defensive priority

Authenticated administrators should urgently review and update Metabase instances to prevent potential Java code execution.

Recommended defensive actions

• Review and update Metabase instances to version 1.58.15.1, 1.59.12, 1.60.6.3, or 1.61.2
• Restrict access to Metabase database creation to trusted administrators
• Monitor Metabase instance for suspicious activity
• Verify H2 connection properties are validated properly
• Implement compensating controls to detect potential exploitation
• Review vendor documentation for additional guidance
• Track exceptions and retest remediated assets

Evidence notes

Metabase versions from 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2 did not validate unsafe H2 connection properties, allowing authenticated administrators to execute arbitrary Java code. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2. The vulnerability has a CVSS score of 9.1 and is considered critical. There is no evidence of public exploitation, but defenders should verify H2 connection properties are validated properly and implement compensating controls to detect potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.