Loading story…
Metabase disclosed CVE-2026-59827, a critical unsafe deserialization vulnerability that can lead to remote code execution on the Metabase server when instances use an H2 database connection, including the default sample database. The flaw allows an authenticated user with permission to run native H2 queries to return query result columns of type OTHER, causing Metabase to deserialize arbitrary Java objects. The issue carries a CVSS 9.9 rating and affects versions 1.58.0 through before 1.58.15, 1.59.0 through before 1.59.12, 1.60.0 through before 1.60.6.3, and 1.61.0 through before 1.61.1.4.
A related Metabase code change in the H2 database driver shows the remediation path: the application now checks JDBC result metadata and rejects columns typed as JAVA_OBJECT instead of attempting to parse them. That defensive change blocks unsafe handling of serialized Java objects in H2 query results and aligns with the vendor fixes released in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-59827 was publicly disclosed as a critical Metabase unsafe deserialization vulnerability with a CVSS 9.9 score. The advisory states it affects versions 1.58.0 through before 1.58.15, 1.59.0 through before 1.59.12, 1.60.0 through before 1.60.6.3, and 1.61.0 through before 1.61.1.4.
Metabase fixed the unsafe deserialization vulnerability CVE-2026-59827 in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4. The flaw affected instances using an H2 database connection and could allow authenticated code execution via native H2 queries returning OTHER-type columns.
A Metabase code change added a defensive check in the H2 database driver to throw an exception when a JDBC result-set column has type JAVA_OBJECT, preventing unsafe parsing of such values.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public reporting and proof-of-concept material further detailed exploitation of **Metabase** pre-auth remote code execution vulnerability `CVE-2023-38646`, showing how an unauthenticated attacker could abuse the product's database setup workflow to achieve code execution. Assetnote previously documented the issue as a pre-auth RCE path in Metabase, and later GitHub research described additional tradecraft around the same flaw. The newer technical note outlined an alternative method that configured the connection as PostgreSQL while invoking the `org.h2.Driver`, using H2 connection-string features to trigger execution and reportedly avoid certain "database already in use" errors seen in other approaches. The write-up included example payloads using `CREATE TRIGGER` and `INIT=RUNSCRIPT` to run shell commands or fetch a remote SQL script, lowering the barrier for attackers to weaponize the vulnerability against exposed Metabase instances.
Aug 15, 2026
Metabase disclosed and patched multiple critical vulnerabilities after a zero-day was exploited against **Metabase Cloud**, prompting urgent warnings for organizations running self-hosted instances. The flaws include two unauthenticated SQL injection issues, `CVE-2026-72898` and `CVE-2026-72899`, and a missing authorization vulnerability, `CVE-2026-72900`. According to the advisories, `CVE-2026-72898` can be abused through the `/reset_password` database endpoint to obtain administrator-level access, and both SQL injection bugs are reported as actively exploited. Metabase said its cloud service was patched for customers, while national cybersecurity authorities urged self-hosted users to update immediately. Affected releases earlier than **63.5, 62.9, 61.11, 60.17, 59.21, and 58.24** should be upgraded to those fixed versions or later across the supported `0.58.x` to `0.63.x` branches. The notices emphasize prompt remediation because the vulnerabilities allow remote, unauthenticated compromise of exposed Metabase deployments.
Aug 12, 2026
Metabase issued an urgent security update after detecting active attacks against the `POST /api/session/reset_password` endpoint, with related requests also observed to `/api/user/current` and affected sessions tied to the `core_session` component. The flaw, tracked as **CVE-2026-72898**, is a critical SQL injection vulnerability in the password reset functionality that can expose internet-facing Metabase instances to compromise. Metabase released patched minimum safe versions across supported branches: **v0.63.5**, **v0.62.9**, **v0.61.11**, **v0.60.17**, **v0.59.21**, and **v0.58.24**. Public detection logic was also added to ProjectDiscovery's Nuclei templates, which checks `/api/session/properties` to identify vulnerable versions, including `0.63.0` through versions earlier than `0.63.5`; until upgrades are completed, Metabase advised defenders to block access to the `/api/session/reset_password` endpoint as a temporary mitigation.
Aug 12, 2026