Metabase CVE-2026-59826

Exploitation requires an authenticated Metabase administrator (CVSS PR:H) with permission to create/register a new database connection, and specifically the ability to add an H2-type datasource with attacker-controlled connection properties - this is the exact feature abused. The vulnerable behavior is limited to one database-creation code path present from 1.55.0 onward, so instances on earlier versions or already on the fixed releases are not affected. No end-user interaction is needed (UI:N) and the endpoint is network-reachable (AV:N), but the hard limiting factor is that the attacker must already hold admin rights and be able to reach the admin database-configuration interface; environments that lock down admin access or disallow H2 datasources substantially constrain the attack.

The signals are moderately consistent but qualified by the privilege requirement. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 Critical) reflects network-reachable, low-complexity exploitation with total confidentiality/integrity/availability impact and a scope change to the host - but PR:H means the attacker must already hold Metabase administrator rights, which materially lowers real-world exploitability versus an unauthenticated RCE. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; treat exploitation status as 'no public exploit identified at time of analysis.' In SSVC terms this is high technical impact but with a meaningful access precondition (admin), so it is best framed as a privilege-escalation/lateral-movement and insider or post-compromise risk rather than a mass-exploitable internet threat. The main uncertainty: an admin account is trusted by design, so the practical severity depends heavily on how tightly admin access is controlled and whether the instance is internet-exposed.

An attacker who has obtained Metabase administrator access (via credential theft, phishing, or a malicious insider) navigates to the Add Database workflow and registers a new H2 connection whose properties embed a Java routine (e.g., a CREATE ALIAS/TRIGGER or INIT payload). When Metabase establishes the connection on the vulnerable code path, the embedded code runs in the server JVM, giving the attacker command execution on the host and, because scope changes, control beyond the application. No public proof-of-concept was identified at time of analysis, and the low attack complexity means a knowledgeable admin-level attacker could trigger it reliably.