shivammittal2403/cve-2026-59827-metabase-cyber-rangeEducational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking production Metabase.
Educational laboratory modeling CVE-2026-59827
(GHSA-w95f-x9v9-wv36):
unsafe deserialization of H2 query result columns of type OTHER in Metabase.
TRAINING ONLY — DO NOT EXPOSE TO THE INTERNET
git clone https://github.com/shivammittal2403/cve-2026-59827-metabase-cyber-range.git
cd cve-2026-59827-metabase-cyber-range
cp .env.example .env
docker compose build && docker compose up -d
Open: http://127.0.0.1:3000
Login: [email protected] / NativeQuery!2026
Attacker: docker exec -it cve59827-attacker bash
Authenticated user + native H2 query → OTHER column → Java object deserialization → RCE (lab: controlled artifact only).
Fixed in Metabase 1.58.15 / 1.59.12 / 1.60.6.3 / 1.61.1.4.
See docs/ for full curriculum (10 CTF levels, detection, forensics, patch).