Code Execution via H2 Database in Metabase

Executive Summary

CVE-2026-59826 is a critical vulnerability in Metabase, an open-source business intelligence tool. The issue occurs because Metabase did not properly validate unsafe H2 database connection properties on a specific database-creation code path. This flaw allows an authenticated administrator to register a specially crafted H2 database connection that can execute arbitrary Java code on the Metabase server.

The vulnerability affects Metabase versions from 1.55.0 up to but not including 1.58.15.1, 1.59.12, 1.60.7, and 1.61.2, where it has been fixed by adding improved validation of database connection details.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-59826 is a critical vulnerability in Metabase that allows an authenticated administrator to execute arbitrary Java code on the server by registering a crafted H2 database connection. This can lead to a complete compromise of the Metabase server, impacting confidentiality, integrity, and availability of data.

Such a vulnerability could severely affect compliance with common standards and regulations like GDPR and HIPAA, which require strict controls to protect sensitive data and ensure system integrity and availability. Unauthorized code execution and potential data breaches violate these regulatory requirements.

Therefore, if exploited, this vulnerability could lead to non-compliance with these standards due to unauthorized access, data exposure, or disruption of services.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an authenticated administrator to execute arbitrary Java code on the Metabase server. This means an attacker with admin privileges could potentially take full control of the server, leading to complete compromise of confidentiality, integrity, and availability of the system.

• Execution of arbitrary code on the server
• Potential full system compromise
• High impact on confidentiality, integrity, and availability
• Network-based attack vector requiring high privileges but no user interaction

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated administrator registering a crafted H2 database connection with unsafe connection properties to execute arbitrary Java code on the Metabase server.

Detection would involve monitoring for suspicious database connection registrations, especially those involving H2 databases with unusual or unsafe connection parameters.

Since the vulnerability requires administrator privileges and crafted H2 connection details, commands or logs to check would include auditing Metabase administrative actions related to database creation or connection registration.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Metabase to a patched version that fixes this vulnerability.

• Upgrade to Metabase version 1.58.15.1, 1.59.12, 1.60.7 (or later 1.60.6.3 as per some releases), or 1.61.2, which include fixes for CVE-2026-59826.
• Back up your Metabase application database before performing the upgrade.

These versions introduce improved validation of database connection details to prevent unsafe H2 connection properties from being registered.

Useful 0 Not Useful 0