Critical
Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
Type: advisorySources: OSV
Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-59826
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 16:57 UTC · Revision 1
Source evidence
Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
core-osv · Original sourcePublished 9 Jul 2026, 17:46 UTC
Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
osv:CVE-2026-59826
Complete source record
{
"id": "348ef3ff2b29687d1105abaf37cbc8d430f4a86d85767d630d55f7966bbdc401",
"url": "https://osv.dev/vulnerability/CVE-2026-59826",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Metabase: Arbitrary Code Execution via Database Connection Detail Bypass",
"summary": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.",
"evidence": "osv:CVE-2026-59826",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-59826",
"aliases": [
"CVE-2026-59826",
"GHSA-8wx2-rxp2-4x35"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/metabase/metabase",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "74032e5e0a5a70dc45a6a744d37b9ba24eee8d01"
},
{
"fixed": "af0cbaa010cdc0d049512fd1c39d44e4694beb12"
},
{
"fixed": "2996c7fee5a82b33453368db60186e64fbaa0d3b"
},
{
"fixed": "34b449b6335d13cd412f50e28356ebf576bcdcc1"
},
{
"fixed": "0c64e27763e13123766434979ed3e41f0cd185bc"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "74032e5e0a5a70dc45a6a744d37b9ba24eee8d01"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "af0cbaa010cdc0d049512fd1c39d44e4694beb12"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.58.15.1"
},
{
"range": [
{
"fixed": "2996c7fee5a82b33453368db60186e64fbaa0d3b"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.59.12"
},
{
"range": [
{
"fixed": "34b449b6335d13cd412f50e28356ebf576bcdcc1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.60.6.3"
},
{
"range": [
{
"fixed": "0c64e27763e13123766434979ed3e41f0cd185bc"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.61.2"
}
]
}
}
],
"versions": [
"v0.58.15.x",
"v0.58.15",
"v0.61.1.5",
"v0.61.1.4",
"v0.60.6.2",
"v0.61.1.3",
"v0.58.14.x",
"v0.58.14.1",
"v0.61.1.2",
"v0.60.6.1",
"v0.61.1.1",
"v0.60.6.x",
"v0.60.6",
"v0.61.1.x",
"v0.61.1",
"v0.60.5.3",
"v0.61.0.10-beta",
"v0.60.5.2",
"v0.57.19.x",
"v0.57.19.1",
"v0.60.5.x",
"v0.60.5",
"v0.61.0.9-beta",
"v0.60.5.1",
"v0.60.4.3",
"v0.59.11.x",
"v0.59.11",
"v0.61.x",
"v0.61.0.x",
"v0.61.0.8-beta",
"v0.59.10.x",
"v0.59.10.1",
"v0.59.10",
"v0.61.0.7-beta",
"v0.60.4.x",
"v0.60.4.4",
"v0.61.0.6-beta",
"v0.58.14",
"v0.57.19",
"v0.60.4.2",
"v0.61.0.5-beta",
"v0.58.13.x",
"v0.58.13.1",
"v0.57.18.x",
"v0.57.18",
"v0.60.4.1",
"v0.61.0.4-beta",
"v0.60.4",
"v0.60.3.x",
"v0.60.3.8",
"v0.60.3.7",
"v0.61.0.3-beta",
"v0.60.3.6",
"v0.60.3.5",
"v0.60.3.4",
"v0.61.0.2-beta",
"v0.60.3.3",
"v0.61.0.1-beta",
"v0.61.0-beta",
"v0.59.9.x",
"v0.59.9.1",
"v0.60.3.2",
"v0.59.9",
"v0.60.3.1",
"v0.60.3",
"v0.59.8.3",
"v0.60.2.x",
"v0.60.2.6",
"v0.60.2.5",
"v0.60.2.4",
"v0.59.8.4",
"v0.59.8.x",
"v0.59.8.5",
"v0.60.2.3",
"v0.59.8.2",
"v0.59.8.1",
"v0.60.2.1",
"v0.60.2.2",
"v0.60.2",
"v0.60.1.x",
"v0.60.1.6",
"v0.60.1.5",
"embedding-sdk-0.60.0",
"v0.59.8",
"v0.59.7.x",
"v0.59.7.3",
"v0.60.1.4",
"v0.60.1.3",
"v0.59.7.2",
"v0.60.1.2",
"v0.59.7.1",
"v0.60.1.1",
"v0.60.1",
"v0.59.7",
"v0.60.0.8-beta",
"v0.58.13",
"v0.59.6.4",
"v0.60.0.7-beta",
"v0.59.6.5",
"v0.60.0.6-beta",
"v0.57.17.x",
"v0.57.17",
"v0.59.6.3",
"v0.59.6.x",
"v0.59.6.2",
"v0.60.0.5-beta",
"v0.58.12.x",
"v0.58.12",
"v0.59.6",
"v0.60.0.4-beta",
"v0.59.5.2",
"v0.59.6.1",
"v0.58.11.x",
"v0.58.11",
"embedding-sdk-60-stable",
"embedding-sdk-0.60.0-beta.0",
"v0.59.5",
"v0.59.5.x",
"v0.59.5.1",
"v0.59.4.x",
"v0.59.4.5",
"v0.60.x",
"v0.60.0.x",
"v0.60.0.3-beta",
"v0.60.0.2-beta",
"v0.59.4.4",
"v0.60.0-beta",
"v0.59.4.3",
"v0.60.0.1-beta",
"v0.58.10.x",
"v0.58.10.1",
"v0.59.4.2",
"v0.58.10",
"v0.59.4.1",
"v0.57.16",
"v0.59.4",
"v0.59.3.x",
"v0.59.3.2",
"v0.59.3.1",
"v0.58.9.2",
"v0.59.3",
"v0.59.2.7",
"v0.58.9.1",
"v0.59.2.6",
"v0.59.2.5",
"v0.59.2.4",
"v0.59.2.3",
"v0.59.2.2",
"v0.58.9.x",
"v0.58.9",
"v0.59.2.1",
"v0.59.2.x",
"v0.59.2",
"v0.59.1.6",
"v0.58.8.5",
"v0.59.1.5",
"v0.58.8.6",
"v0.59.1.4",
"v0.59.1.3",
"v0.59.1.2",
"v0.58.8.3",
"v0.57.15.x",
"v0.57.15",
"v0.58.8.4",
"v0.59.1.1",
"embedding-sdk-0.59.0",
"v0.58.8.2",
"v0.57.14.x",
"v0.57.14",
"v0.58.8.1",
"v0.59.1.x",
"v0.59.1",
"v0.58.8.x",
"v0.58.8",
"v0.58.7.6",
"v0.59.0.7-beta",
"v0.58.7.5",
"v0.59.0.6-beta",
"v0.57.13",
"v0.58.7.3",
"v0.59.0.5-beta",
"v0.58.7.4",
"v0.58.7.2",
"v0.59.0.4-beta",
"v0.59.0.3-beta",
"v0.58.7.x",
"v0.58.7.1",
"v0.59.0.2-beta",
"v0.58.7",
"v0.58.6.1",
"embedding-sdk-59-stable",
"embedding-sdk-0.59.0-beta.0",
"v0.57.12.x",
"v0.57.12",
"v0.58.6.x",
"v0.58.6",
"v0.59.0.x",
"v0.59.0.1-beta",
"v0.59.x",
"v0.59.0-beta",
"v0.58.5.5",
"v0.58.5.3",
"v0.58.5.2",
"v0.58.5.1",
"v0.58.5.4",
"v0.58.4",
"v0.58.x",
"v0.58.5.x",
"v0.58.5",
"latest-oss",
"latest-ee",
"v0.57.11",
"v0.58.4.x",
"v0.58.4.2",
"v0.58.4.1",
"v0.58.3.x",
"v0.58.3.4",
"v0.57.10.6",
"v0.58.3.3",
"v0.57.10.5",
"v0.57.x",
"v0.57.11.x",
"v0.57.11.1",
"v0.57.10.x",
"v0.57.10.7",
"v0.58.3.2",
"v0.57.10.4",
"v0.58.3.1",
"v0.58.3",
"v0.57.10.3",
"v0.57.10.2",
"v0.57.10",
"v0.58.2.x",
"v0.58.2.6",
"v0.58.2.5",
"v0.57.9.x",
"v0.57.9.4",
"v0.57.10.1",
"v0.57.9.3",
"v0.58.2.4",
"v0.58.2.3",
"v0.58.2.2",
"v0.57.9.2",
"v0.57.9.1",
"v0.57.9",
"v0.58.2.1",
"v0.58.2",
"v0.58.1.x",
"v0.58.1.3",
"v0.57.8.x",
"v0.57.8.2",
"embedding-sdk-58-stable",
"embedding-sdk-0.58.0",
"v0.58.1.2",
"v0.57.8.1",
"v0.57.8",
"v0.58.1.1",
"v0.58.1",
"v0.57.7.x",
"v0.57.7.16",
"v0.57.7.15",
"v0.57.7.14",
"v0.57.7.13",
"v0.57.7.12",
"v0.58.0.x",
"v0.58.0.10-beta",
"v0.58.0.9-beta",
"v0.57.7.11",
"v0.58.0.8-beta",
"v0.57.7.10",
"v0.57.7.9",
"v0.58.0.7-beta",
"v0.58.0.6-beta",
"v0.57.7.8",
"v0.58.0.5-beta",
"v0.57.7.7",
"v0.58.0.4-beta",
"v0.57.7.6",
"v0.58.0.3-beta",
"embedding-sdk-0.58.0-beta.0",
"v0.57.7.5",
"v0.57.7.4",
"v0.57.7.3",
"v0.57.7.2",
"v0.58.0.2-beta",
"v0.57.7.1",
"v0.58.0.1-beta",
"v0.57.7",
"v0.58.0-beta",
"v0.57.6.x",
"v0.57.6.3",
"v0.57.6.2",
"v0.57.6.1",
"v0.57.6",
"v0.57.5.x",
"v0.57.5.9",
"v0.57.5.8",
"v0.57.5.7",
"v0.57.5.6",
"v0.57.5.5",
"v0.57.5.4",
"v0.57.5.3",
"v0.57.5.2",
"v0.57.5.1",
"v0.57.5",
"v0.57.4.x",
"v0.57.4.4",
"v0.57.4.3",
"v0.57.4.2",
"v0.57.4.1",
"v0.57.4",
"v0.57.3.3",
"v0.57.3.1",
"v0.57.3.x",
"v0.57.3.2",
"v0.57.3",
"v0.57.2.x",
"v0.57.2.7",
"v0.57.2.6",
"v0.57.2.5",
"v0.57.2.4",
"v0.57.2.3",
"embedding-sdk-57-stable",
"embedding-sdk-0.57.0",
"v0.57.2.2",
"embedding-sdk-0.57.0-beta.1",
"v0.57.2.1",
"v0.57.2",
"v0.57.1.x",
"v0.57.1.1",
"v0.57.1",
"embedding-sdk-0.57.0-beta.0",
"v0.57.0-beta",
"embedding-sdk-0.57.0-alpha.3",
"embedding-sdk-0.57.0-alpha.2",
"embedding-sdk-0.57.0-alpha.1",
"embedding-sdk-0.57.0-alpha.0",
"v0.55.0-beta",
"beta-oss",
"beta-ee",
"embedding-sdk-0.55.1-nightly",
"embedding-sdk-0.54.3-nightly",
"embedding-sdk-0.54.2-nightly",
"embedding-sdk-0.54.1-nightly",
"embedding-sdk-0.53.1-nightly",
"embedding-sdk-0.52.4-nightly",
"embedding-sdk-0.52.3-nightly",
"v1.52.0-beta",
"v0.52.0-beta",
"embedding-sdk-0.52.2-nightly",
"embedding-sdk-1.52.1",
"embedding-sdk-0.52.1-nightly",
"embedding-sdk-0.1.38",
"embedding-sdk-0.1.37",
"embedding-sdk-0.1.36",
"embedding-sdk-0.1.35",
"embedding-sdk-0.1.34",
"embedding-sdk-0.1.33",
"embedding-sdk-0.1.32",
"embedding-sdk-0.1.31",
"embedding-sdk-0.1.30",
"embedding-sdk-0.1.29",
"embedding-sdk-0.1.28",
"embedding-sdk-0.1.27",
"embedding-sdk-0.1.26",
"embedding-sdk-0.1.25",
"embedding-sdk-0.1.24",
"embedding-sdk-0.1.23",
"embedding-sdk-0.1.22",
"embedding-sdk-0.1.21",
"embedding-sdk-0.1.20",
"embedding-sdk-0.1.19",
"embedding-sdk-0.1.18",
"embedding-sdk-0.1.17",
"embedding-sdk-0.1.16",
"embedding-sdk-0.1.15",
"embedding-sdk-0.1.14",
"embedding-sdk-0.1.13",
"embedding-sdk-0.1.12",
"embedding-sdk-0.1.11",
"embedding-sdk-0.1.10",
"embedding-sdk-0.1.9",
"embedding-sdk-0.1.8",
"embedding-sdk-0.1.7",
"embedding-sdk-0.1.6",
"embedding-sdk-0.1.5",
"embedding-sdk-0.1.4",
"embedding-sdk-0.1.2",
"embedding-sdk-0.1.0",
"v1.48.0-RC1",
"v0.48.0-RC1",
"v1.47.0-RC1",
"v0.47.0-RC1",
"v1.45.0-RC2",
"v0.45.0-RC2",
"v1.45.0-RC1",
"v0.45.0-RC1",
"rm",
"v1.44.0-RC1",
"v0.44.0-RC1",
"v1.43.0-rc1",
"v0.43.0-rc1",
"v1.42.0-rc2",
"v1.42.0-preview1",
"v0.42.0-preview1",
"v1.41.0-RC1",
"v0.41.0-RC1",
"v1.40.0",
"v0.40.0",
"v1.40.0-rc2",
"v0.40.0-rc2",
"v0.40.0-rc1-dan",
"v0.38.0-rc4",
"v0.38.0-rc3",
"v0.38.0-rc2",
"v0.38.0-rc1",
"v0.38.0-preview",
"v0.37.0-rc2",
"v0.36.0-snapshot",
"v0.35.0",
"v0.35.0-rc2",
"v0.35.0-rc1",
"blah",
"0.34.0-rc1",
"v0.26.0.RC1",
"v0.13.0",
"v0.12.0",
"v0.12.0-test",
"v0.11.3",
"v0.11.2",
"v0.11.1",
"v0.10.4.1",
"v0.11.0",
"v0.10.4",
"v0.10.3",
"0.10.3",
"v0.10.0",
"v0.9-final",
"v20150604-alpha",
"v20150603-alpha",
"v20150601-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59826.json"
}
}
],
"modified": "2026-10-28T02:30:30.637844376Z",
"provider": "osv",
"references": [
"https://github.com/metabase/metabase/releases/tag/v0.58.15.1",
"https://github.com/metabase/metabase/releases/tag/v0.59.12",
"https://github.com/metabase/metabase/releases/tag/v0.60.6.3",
"https://github.com/metabase/metabase/releases/tag/v0.61.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59826.json",
"https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35",
"https://nvd.nist.gov/vuln/detail/CVE-2026-59826",
"https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "1.55.0"
},
{
"fixed": "1.58.15.1"
},
{
"introduced": "1.59.0"
},
{
"fixed": "1.59.12"
},
{
"introduced": "1.60.0"
},
{
"fixed": "1.60.6.3"
},
{
"introduced": "1.61.0"
},
{
"fixed": "1.61.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "1.58.15.1"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59826.json"
}
},
"related_cves": [
{
"value": "CVE-2026-59826",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497648,
"published_at": "2026-07-09T17:46:36.365+00:00"
}