CVE Vulnerability in Metabase Affected by Unsafe H2 Connection Properties
CVE-2026-59826
What is CVE-2026-59826?
CVE-2026-59826 is a notable vulnerability identified in Metabase, an open-source business intelligence and embedded analytics platform. This tool is primarily utilized for facilitating data analysis and reporting within organizations, allowing users to create visualizations, dashboards, and perform complex data queries. The vulnerability arises from the failure of Metabase to properly validate unsafe H2 connection properties in certain database creation scenarios between specific software versions. As a result, an authenticated administrator could craft an exploitable H2 database connection, leading to the execution of arbitrary Java code on the Metabase server. Such exploitation could have severe implications for organizations, potentially allowing attackers to gain unauthorized access, manipulate data, or disrupt operations.
Potential impact of CVE-2026-59826
-
Unauthorized Code Execution: The vulnerability enables an authenticated administrator to execute arbitrary Java code on the Metabase server. This could lead to significant security breaches, where attackers gain control over the server and execute malicious operations.
-
Data Integrity Compromise: With the capacity to execute arbitrary code, an attacker could potentially alter or corrupt data within Metabase, undermining the trustworthiness of critical business intelligence and reporting efforts.
-
Operational Disruption: Exploiting this vulnerability could result in downtime for organizations reliant on Metabase for their data analytics. The execution of malicious code or alterations to the system could lead to delays in reporting and decision-making processes.
Affected Version(s)
metabase >= 1.55.0, < 1.58.15.1 < 1.55.0, 1.58.15.1
metabase >= 1.59.0, < 1.59.12 < 1.59.0, 1.59.12
metabase >= 1.60.0, < 1.60.6.3 < 1.60.0, 1.60.6.3