CVE-2026-59827: Metabase Unsafe Deserialization in H2 Native Queries

Severity: Critical (CVSS 9.9)

CVE: CVE-2026-59827

Reporter: Matheus Gutierre (@Gutierre0x80)

Published: June 30, 2026

Vulnerability Summary

An authenticated user with access to native SQL queries on an H2 database can execute arbitrary Java code on the Metabase server via unsafe deserialization of Java objects returned from SELECT CAST(X'...' AS OTHER) queries.

The default Metabase installation includes an H2 sample database, making this vulnerability exploitable on all default deployments.

Affected Versions

Metabase >= 1.58.0, < 1.58.15
Metabase >= 1.59.0, < 1.59.12
Metabase >= 1.60.0, < 1.60.6.3
Metabase >= 1.61.0, < 1.61.1.4

Patched Versions

Metabase 1.58.15
Metabase 1.59.12
Metabase 1.60.6.3
Metabase 1.61.1.4

Installation

Prerequisites

Python 3.7+
requests library: pip install requests
Java (OpenJDK 11+)
JAR file must be in the same directory as exploit.py:
clojure-1.12.3.jar (required for payload generation)

Setup

Ensure all prerequisites are installed and available in PATH:

# Install Python requests library
pip install requests

# Verify Java is available (OpenJDK 11+)
java -version

# Verify Python 3.7+
python3 --version

Then run the exploit from the poc/ directory:

cd poc/
python3 exploit.py <target_url> <username> <password> <command>

The script validates that clojure-1.12.3.jar and VarChainPayload.class exist in the working directory before execution.

Usage

python3 exploit.py <target_url> <username> <password> <command>

Arguments

Argument	Description	Example
`target_url`	Metabase instance URL	`http://127.0.0.1:3000`
`username`	Authenticated user (admin or with native query access)	`[email protected]`
`password`	User password	`SecurePassword123!`
`command`	Shell command to execute	`id` or `whoami`

Example

python3 exploit.py http://127.0.0.1:3000 [email protected] Admin1234! "id > /tmp/pwned.txt"

The command is executed in the context of the Metabase process (typically the metabase user in Docker).

Technical Details

The H2 OTHER column type deserializes Java objects using a bare ObjectInputStream without JEP-290 filtering. This allows arbitrary class instantiation.

The payload uses a gadget chain based on Clojure's serializable classes (clojure.core$apply, clojure.lang.Var$Serialized, and PersistentList) combined with Java's PriorityQueue to trigger code execution via clojure.core/eval.

See writeup/analysis.md for full technical analysis.

References

Official Advisory: https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36
CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59827