What is the CVSS score of CVE-2026-59827?

CVE-2026-59827 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Metabase are affected by CVE-2026-59827?

Metabase deployments using H2 database connections face a remote code execution vulnerability (CVSS 8.8) that could allow database query access to escalate into full server compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2026-59827?

Yes, a public proof-of-concept exploit is available for CVE-2026-59827. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-59827?

Within 24 hours, identify and catalog all Metabase instances across the organization, distinguishing those using H2 database connections and assessing user populations with native query execution rights. Within 7 days, deploy the vendor patch (referenced in GHSA-w95f-x9v9-wv36) across all affected Metabase instances and verify patch installation through version checks; prioritize instances exposed to non-administrative users. Within 30 days, conduct access control review to restrict native query privileges to trusted administrative staff only, implement query logging and alerting for anomalous H2 query patterns, and document all patched instances for compliance tracking.

Metabase CVE-2026-59827

EUVD-2026-42659 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-09 security-advisories@github.com

Java Deserialization Metabase

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (github) PRIMARY

CRITICAL

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable and low-complexity, but requires an authenticated user with native-query rights (PR:L); deserialization yields full RCE, so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 14:44 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 13, 2026 - 14:43 vuln.today

Analysis Updated

Jul 13, 2026 - 14:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 14:37 vuln.today

cvss_changed

Severity Changed

Jul 13, 2026 - 14:37 NVD

CRITICAL HIGH

CVSS changed

Jul 13, 2026 - 14:37 NVD

9.9 (CRITICAL) 8.8 (HIGH)

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:43 vuln.today

DescriptionNVD

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.

Articles & Coverage 2

News 3 New Java Vulnerabilities - 2 Critical, 1 High Severity Jul 10, 2026 News Critical RCE in Metabase Business Intelligence Server (Java) - CVE-2026-59827 Jul 09, 2026

AnalysisAI

Remote code execution in Metabase's H2 database driver allows an authenticated user with native-query privileges to run arbitrary Java on the server. When Metabase returns H2 result columns of type OTHER (JDBC JAVA_OBJECT), it deserializes the embedded Java object without validation, so a crafted native H2 query triggers CWE-502 unsafe deserialization and full server compromise. It affects any instance using an H2 connection, including the default bundled sample database. No public exploit is identified at time of analysis (SSVC exploitation: none; EPSS 0.45%), though the upstream fix commit and vendor advisory GHSA-w95f-x9v9-wv36 are public.

Technical ContextAI

Metabase is a Clojure/Java open-source business intelligence platform. The flaw lives in the H2 JDBC driver integration (src/metabase/driver/h2.clj), which reads result-set columns via .getObject. H2 supports a native column type OTHER that maps to JDBC Types.JAVA_OBJECT and carries a serialized Java object; calling .getObject on such a column invokes Java native deserialization (ObjectInputStream) on attacker-influenced bytes. This is a textbook CWE-502 (Deserialization of Untrusted Data): the H2 engine performs the deserialization when the query result is materialized, so any gadget chain on the Metabase classpath can lead to code execution. The fix inspects .getColumnType and throws 'Unable to parse jdbc type' whenever the column type is Types/JAVA_OBJECT, refusing to deserialize OTHER columns entirely.

RemediationAI

Vendor-released patch: upgrade to Metabase 1.58.15, 1.59.12, 1.60.6.3, or 1.61.1.4 (community tags v0.58.15, v0.59.12, v0.60.6.3, v0.61.1.4), which reject H2 columns of type JAVA_OBJECT instead of deserializing them (fix commit 00f42511fe3bc4385652a2e96862ee6fd7d42cf8); see the advisory at https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36 and the corresponding GitHub release tags. If immediate patching is not possible, revoke native (raw SQL) query permissions on all H2-backed databases and, where feasible, remove or disconnect the bundled H2 sample database and any production H2 connections, migrating analytics to a non-H2 warehouse; the trade-off is that analysts lose native-query capability against those sources and the sample dataset becomes unavailable. Additionally restrict who holds data-editor/native-query roles, since exploitation depends on that privilege.