Critical Metabase H2 Deserialization Flaw Enables Authenticated RCE
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 9, 2026
Metabase disclosed CVE-2026-59827, a critical unsafe deserialization vulnerability that can lead to remote code execution on the Metabase server when instances use an H2 database connection, including the default sample database. The flaw allows an authenticated user with permission to run native H2 queries to return query result columns of type OTHER, causing Metabase to deserialize arbitrary Java objects. The issue carries a CVSS 9.9 rating and affects versions 1.58.0 through before 1.58.15, 1.59.0 through before 1.59.12, 1.60.0 through before 1.60.6.3, and 1.61.0 through before 1.61.1.4.
A related Metabase code change in the H2 database driver shows the remediation path: the application now checks JDBC result metadata and rejects columns typed as JAVA_OBJECT instead of attempting to parse them. That defensive change blocks unsafe handling of serialized Java objects in H2 query results and aligns with the vendor fixes released in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
