c0gnit00/cve-2026-59827Blog on CVE-2026-59827, Unsafe H2 query ouput deserialization
GHSA-w95f-x9v9-wv36 | CVSS 9.9 Critical | CWE-502: Deserialization of Untrusted Data
CVE-2026-59827 is a critical remote code execution vulnerability in Metabase, the popular open-source business intelligence and data analytics platform. The flaw stems from how Metabase handles query results returned by an H2 database connection. When a native SQL query against an H2 source returns a column typed as OTHER, Metabase deserializes the raw bytes of that column into a Java object without performing any validation. An authenticated user who can run native queries is therefore able to smuggle a malicious serialized payload into the result set and trigger arbitrary code execution on the server hosting Metabase.
The vulnerability was assigned a CVSS score of 9.9, reflecting the minimal preconditions required and the full server-side code execution that results from successful exploitation.
Metabase ships two parallel edition tracks from the same release cycle. The open-source edition uses version numbers prefixed with 0 — for example, v0.61.1. The enterprise (commercial) edition uses version numbers prefixed with 1 — for example, v1.61.1. Both editions share the same underlying codebase and are released together, so a vulnerability that affects v1.61.0 equally affects v0.61.0. Throughout this write-up, version numbers are written using the enterprise 1.xx prefix, but every affected version maps directly to its 0.xx open-source counterpart by replacing the leading 1 with 0.
Both CVE-2026-59826 and CVE-2026-59827 were disclosed together in July 2026. They share overlapping version ranges but have different patch points.
The vulnerable enterprise releases are 1.58.0 through 1.58.14, 1.59.0 through 1.59.11, 1.60.0 through 1.60.6.2, and 1.61.0 through 1.61.1.3. The corresponding open-source releases are 0.58.0 through 0.58.14, 0.59.0 through 0.59.11, 0.60.0 through 0.60.6.2, and 0.61.0 through 0.61.1.3.
An internal patch was first issued as 1.61.1.4 (enterprise) and 0.61.1.4 (open-source). The first publicly available fixed release in the 1.61 line is 1.61.2 (v1.61.2.x / v0.61.2.x). Metabase Cloud instances were patched automatically by the provider.
The vulnerable enterprise releases are 1.55.0 through 1.58.15.0, 1.59.0 through 1.59.11, 1.60.0 through 1.60.6.2, and 1.61.0 through the entire 1.61.1.x line. The first fully patched public release is 1.61.2 (v1.61.2.x / v0.61.2.x). The scope of CVE-2026-59826 is broader, reaching back to the 1.55 release line, reflecting the longer-standing presence of the insufficiently validated database-creation code path it exploits.
Java's serialization mechanism allows an object in memory to be converted into a flat stream of bytes, stored or transmitted, and then reconstructed later by calling ObjectInputStream.readObject(). The critical property of this mechanism is that reconstruction executes code. Class constructors, readObject overrides, and finalizers all run during deserialization. If the bytes being read come from an untrusted source, an attacker can craft them to trigger arbitrary method calls through a sequence of existing, legitimate classes already loaded in the JVM. These sequences are known as gadget chains.
Gadget chains do not require introducing any new code to the application. They exploit the wiring of existing library classes whose normal methods, when called in the right order during deserialization, eventually reach a sink such as Runtime.exec(). Tools like ysoserial exist specifically to generate these payloads for widely deployed libraries such as Apache Commons Collections, Spring Framework, and others.
H2 is a pure-Java embedded relational database. It defines a special SQL column type called OTHER that acts as a pass-through for arbitrary Java objects. When H2 stores a value in an OTHER column, it writes the bytes produced by Java's ObjectOutputStream. When it reads the value back, it calls ObjectInputStream.readObject() to reconstruct the object. The raw serialized bytes can also be supplied directly in a query using H2's hexadecimal literal syntax:
SELECT CAST(X'ACED0005...' AS OTHER);
-- or
SELECT X'ACED0005...'::OTHER;
The prefix ACED followed by 0005 is the Java serialization stream magic number and protocol version. Any hex string beginning with ACED0005 is a Java serialized object stream.
When H2 processes this query, it deserializes the hex bytes on the database side. The resulting object is then passed back to the calling application through the JDBC ResultSet. If the application inspects the column value — for example, to format it for display — it may trigger additional processing. This is exactly what Metabase does in the vulnerable code path.
Metabase receives the JDBC ResultSet from the H2 driver and inspects column metadata to decide how to render each value for the user. When it encounters a column with the JDBC type Types.OTHER (also reported as JAVA_OBJECT), the vulnerable versions of Metabase attempt to deserialize the raw bytes in order to produce a displayable representation. This deserialization call, ObjectInputStream.readObject(), executes without any whitelist filtering or class validation.
The sequence of events is:
OTHER containing a crafted serialized payload.JAVA_OBJECT column in the ResultSet.OTHER column type and calls readObject() on the bytes.Runtime.exec() and executing the attacker's command as the OS user running the Metabase process.The patched versions resolve the issue by inspecting JDBC result metadata before attempting any deserialization. If a column is typed as JAVA_OBJECT, Metabase now rejects it outright rather than trying to parse it.
Exploitation requires authentication. The attacker must hold a Metabase account with native query execution permission on an H2-backed database. Administrator accounts satisfy this by default. Regular user accounts can also satisfy this requirement if an administrator has granted them the native queries data permission for the relevant database.
Metabase removed support for adding H2 as a new data warehouse connection in version 0.46.6.4, released in 2023. Attempting to register a new H2 connection through the admin interface returns the error "H2 is not supported as a data warehouse." This removal was a response to earlier H2-related vulnerabilities and was intended to eliminate the risk of connecting to attacker-controlled H2 instances.
However, H2 removal from the data warehouse connection UI is not the same as H2 removal from Metabase. Two H2 databases remain present in every default Metabase installation.