CVE-2026-59827— Metabase: Unsafe Deserialization of H2 Query Results
In-the-Wild Activity Observed github_trending · low
Possible ATT&CK Techniques 1AI
T1210 · Exploitation of Remote ServicesGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59827
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Metabase: Unsafe Deserialization of H2 Query Results
Source: CVE Program / CVE List V5
Vulnerability Description
Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Metabase 反序列化注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Metabase是美国Metabase公司开源的一个开源数据分析平台。 Metabase存在反序列化注入漏洞，该漏洞源于对H2本机查询结果列中返回的任意Java对象未进行验证的反序列化，可能导致经过身份验证的用户在Metabase服务器上执行代码。以下版本受到影响：1.58.15之前版本、1.59.12之前版本、1.60.6.3之前版本和1.61.1.4之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59827
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59827
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59827 (1)
Vendor Advisories for CVE-2026-59827 (1)
Vendor Pages for CVE-2026-59827 (3)
IV. Related Vulnerabilities
Same product: metabase
- CVE-2026-72900
Metabase information exposure - CVE-2026-72899
Metabase SQL injection via public card or dashboard - CVE-2026-72898
Metabase SQL injection via password reset endpoint - CVE-2026-50147
Metabase: Arbitrary File Read via MySQL Connection Property - CVE-2026-50148
Metabase: Remote Code Execution via Snowflake JDBC Driver Ar
Same vendor: metabase
- CVE-2026-72900
Metabase information exposure - CVE-2026-72899
Metabase SQL injection via public card or dashboard - CVE-2026-72898
Metabase SQL injection via password reset endpoint - CVE-2026-50147
Metabase: Arbitrary File Read via MySQL Connection Property - CVE-2026-50148
Metabase: Remote Code Execution via Snowflake JDBC Driver Ar
Same weakness: CWE-502
- CVE-2024-13784
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= - CVE-2026-10035
Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Adm - CVE-2026-16099
Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contribu - CVE-2025-7639
AVEVA Enterprise SCADA Deserialization of Untrusted Data - CVE-2026-19826
alldatacenter alldata xxl-rpc Listener HessianSerializer.jav
V. Comments for CVE-2026-59827
No comments yet