CVE-2026-59826

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59826

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59826.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-59826

Aliases

GHSA-8wx2-rxp2-4x35

Published

2026-07-09T17:46:36.365Z

Modified

2026-07-15T01:49:01.589361186Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Details

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.55.0"
                },
                {
                    "fixed": "1.58.15.1"
                },
                {
                    "introduced": "1.59.0"
                },
                {
                    "fixed": "1.59.12"
                },
                {
                    "introduced": "1.60.0"
                },
                {
                    "fixed": "1.60.6.3"
                },
                {
                    "introduced": "1.61.0"
                },
                {
                    "fixed": "1.61.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59826.json"
}

References

Affected packages

Git / github.com/metabase/metabase

Affected ranges

Type

GIT

Repo

https://github.com/metabase/metabase

Events

Introduced

Fixed

74032e5e0a5a70dc45a6a744d37b9ba24eee8d01

Fixed

af0cbaa010cdc0d049512fd1c39d44e4694beb12

Fixed

2996c7fee5a82b33453368db60186e64fbaa0d3b

Fixed

34b449b6335d13cd412f50e28356ebf576bcdcc1

Fixed

0c64e27763e13123766434979ed3e41f0cd185bc

Database specific

{
    "source": "REFERENCES"
}

Affected versions

0.*

0.10.3

0.34.0-rc1

Other

beta-ee

beta-oss

blah

embedding-sdk-57-stable

embedding-sdk-58-stable

embedding-sdk-59-stable

embedding-sdk-60-stable

latest-ee

latest-oss

v20150601-alpha

v20150603-alpha

v20150604-alpha

embedding-sdk-0.*

embedding-sdk-0.1.0

embedding-sdk-0.1.10

embedding-sdk-0.1.11

embedding-sdk-0.1.12

embedding-sdk-0.1.13

embedding-sdk-0.1.14

embedding-sdk-0.1.15

embedding-sdk-0.1.16

embedding-sdk-0.1.17

embedding-sdk-0.1.18

embedding-sdk-0.1.19

embedding-sdk-0.1.2

embedding-sdk-0.1.20

embedding-sdk-0.1.21

embedding-sdk-0.1.22

embedding-sdk-0.1.23

embedding-sdk-0.1.24

embedding-sdk-0.1.25

embedding-sdk-0.1.26

embedding-sdk-0.1.27

embedding-sdk-0.1.28

embedding-sdk-0.1.29

embedding-sdk-0.1.30

embedding-sdk-0.1.31

embedding-sdk-0.1.32

embedding-sdk-0.1.33

embedding-sdk-0.1.34

embedding-sdk-0.1.35

embedding-sdk-0.1.36

embedding-sdk-0.1.37

embedding-sdk-0.1.38

embedding-sdk-0.1.4

embedding-sdk-0.1.5

embedding-sdk-0.1.6

embedding-sdk-0.1.7

embedding-sdk-0.1.8

embedding-sdk-0.1.9

embedding-sdk-0.52.1-nightly

embedding-sdk-0.52.2-nightly

embedding-sdk-0.52.3-nightly

embedding-sdk-0.52.4-nightly

embedding-sdk-0.53.1-nightly

embedding-sdk-0.54.1-nightly

embedding-sdk-0.54.2-nightly

embedding-sdk-0.54.3-nightly

embedding-sdk-0.55.1-nightly

embedding-sdk-0.57.0

embedding-sdk-0.57.0-alpha.0

embedding-sdk-0.57.0-alpha.1

embedding-sdk-0.57.0-alpha.2

embedding-sdk-0.57.0-alpha.3

embedding-sdk-0.57.0-beta.0

embedding-sdk-0.57.0-beta.1

embedding-sdk-0.58.0

embedding-sdk-0.58.0-beta.0

embedding-sdk-0.59.0

embedding-sdk-0.59.0-beta.0

embedding-sdk-0.60.0

embedding-sdk-0.60.0-beta.0

embedding-sdk-1.*

embedding-sdk-1.52.1

v0.*

v0.10.0

v0.10.3

v0.10.4

v0.10.4.1

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.12.0

v0.12.0-test

v0.13.0

v0.26.0.RC1

v0.35.0

v0.35.0-rc1

v0.35.0-rc2

v0.36.0-snapshot

v0.37.0-rc2

v0.38.0-preview

v0.38.0-rc1

v0.38.0-rc2

v0.38.0-rc3

v0.38.0-rc4

v0.40.0

v0.40.0-rc1-dan

v0.40.0-rc2

v0.41.0-RC1

v0.42.0-preview1

v0.43.0-rc1

v0.44.0-RC1

v0.45.0-RC1

v0.45.0-RC2

v0.47.0-RC1

v0.48.0-RC1

v0.52.0-beta

v0.55.0-beta

v0.57.0-beta

v0.57.1

v0.57.1.1

v0.57.1.x

v0.57.10

v0.57.10.1

v0.57.10.2

v0.57.10.3

v0.57.10.4

v0.57.10.5

v0.57.10.6

v0.57.10.7

v0.57.10.x

v0.57.11

v0.57.11.1

v0.57.11.x

v0.57.12

v0.57.12.x

v0.57.13

v0.57.14

v0.57.14.x

v0.57.15

v0.57.15.x

v0.57.16

v0.57.17

v0.57.17.x

v0.57.18

v0.57.18.x

v0.57.19

v0.57.19.1

v0.57.19.x

v0.57.2

v0.57.2.1

v0.57.2.2

v0.57.2.3

v0.57.2.4

v0.57.2.5

v0.57.2.6

v0.57.2.7

v0.57.2.x

v0.57.3

v0.57.3.1

v0.57.3.2

v0.57.3.3

v0.57.3.x

v0.57.4

v0.57.4.1

v0.57.4.2

v0.57.4.3

v0.57.4.4

v0.57.4.x

v0.57.5

v0.57.5.1

v0.57.5.2

v0.57.5.3

v0.57.5.4

v0.57.5.5

v0.57.5.6

v0.57.5.7

v0.57.5.8

v0.57.5.9

v0.57.5.x

v0.57.6

v0.57.6.1

v0.57.6.2

v0.57.6.3

v0.57.6.x

v0.57.7

v0.57.7.1

v0.57.7.10

v0.57.7.11

v0.57.7.12

v0.57.7.13

v0.57.7.14

v0.57.7.15

v0.57.7.16

v0.57.7.2

v0.57.7.3

v0.57.7.4

v0.57.7.5

v0.57.7.6

v0.57.7.7

v0.57.7.8

v0.57.7.9

v0.57.7.x

v0.57.8

v0.57.8.1

v0.57.8.2

v0.57.8.x

v0.57.9

v0.57.9.1

v0.57.9.2

v0.57.9.3

v0.57.9.4

v0.57.9.x

v0.57.x

v0.58.0-beta

v0.58.0.1-beta

v0.58.0.10-beta

v0.58.0.2-beta

v0.58.0.3-beta

v0.58.0.4-beta

v0.58.0.5-beta

v0.58.0.6-beta

v0.58.0.7-beta

v0.58.0.8-beta

v0.58.0.9-beta

v0.58.0.x

v0.58.1

v0.58.1.1

v0.58.1.2

v0.58.1.3

v0.58.1.x

v0.58.10

v0.58.10.1

v0.58.10.x

v0.58.11

v0.58.11.x

v0.58.12

v0.58.12.x

v0.58.13

v0.58.13.1

v0.58.13.x

v0.58.14

v0.58.14.1

v0.58.14.x

v0.58.15

v0.58.15.x

v0.58.2

v0.58.2.1

v0.58.2.2

v0.58.2.3

v0.58.2.4

v0.58.2.5

v0.58.2.6

v0.58.2.x

v0.58.3

v0.58.3.1

v0.58.3.2

v0.58.3.3

v0.58.3.4

v0.58.3.x

v0.58.4

v0.58.4.1

v0.58.4.2

v0.58.4.x

v0.58.5

v0.58.5.1

v0.58.5.2

v0.58.5.3

v0.58.5.4

v0.58.5.5

v0.58.5.x

v0.58.6

v0.58.6.1

v0.58.6.x

v0.58.7

v0.58.7.1

v0.58.7.2

v0.58.7.3

v0.58.7.4

v0.58.7.5

v0.58.7.6

v0.58.7.x

v0.58.8

v0.58.8.1

v0.58.8.2

v0.58.8.3

v0.58.8.4

v0.58.8.5

v0.58.8.6

v0.58.8.x

v0.58.9

v0.58.9.1

v0.58.9.2

v0.58.9.x

v0.58.x

v0.59.0-beta

v0.59.0.1-beta

v0.59.0.2-beta

v0.59.0.3-beta

v0.59.0.4-beta

v0.59.0.5-beta

v0.59.0.6-beta

v0.59.0.7-beta

v0.59.0.x

v0.59.1

v0.59.1.1

v0.59.1.2

v0.59.1.3

v0.59.1.4

v0.59.1.5

v0.59.1.6

v0.59.1.x

v0.59.10

v0.59.10.1

v0.59.10.x

v0.59.11

v0.59.11.x

v0.59.2

v0.59.2.1

v0.59.2.2

v0.59.2.3

v0.59.2.4

v0.59.2.5

v0.59.2.6

v0.59.2.7

v0.59.2.x

v0.59.3

v0.59.3.1

v0.59.3.2

v0.59.3.x

v0.59.4

v0.59.4.1

v0.59.4.2

v0.59.4.3

v0.59.4.4

v0.59.4.5

v0.59.4.x

v0.59.5

v0.59.5.1

v0.59.5.2

v0.59.5.x

v0.59.6

v0.59.6.1

v0.59.6.2

v0.59.6.3

v0.59.6.4

v0.59.6.5

v0.59.6.x

v0.59.7

v0.59.7.1

v0.59.7.2

v0.59.7.3

v0.59.7.x

v0.59.8

v0.59.8.1

v0.59.8.2

v0.59.8.3

v0.59.8.4

v0.59.8.5

v0.59.8.x

v0.59.9

v0.59.9.1

v0.59.9.x

v0.59.x

v0.60.0-beta

v0.60.0.1-beta

v0.60.0.2-beta

v0.60.0.3-beta

v0.60.0.4-beta

v0.60.0.5-beta

v0.60.0.6-beta

v0.60.0.7-beta

v0.60.0.8-beta

v0.60.0.x

v0.60.1

v0.60.1.1

v0.60.1.2

v0.60.1.3

v0.60.1.4

v0.60.1.5

v0.60.1.6

v0.60.1.x

v0.60.2

v0.60.2.1

v0.60.2.2

v0.60.2.3

v0.60.2.4

v0.60.2.5

v0.60.2.6

v0.60.2.x

v0.60.3

v0.60.3.1

v0.60.3.2

v0.60.3.3

v0.60.3.4

v0.60.3.5

v0.60.3.6

v0.60.3.7

v0.60.3.8

v0.60.3.x

v0.60.4

v0.60.4.1

v0.60.4.2

v0.60.4.3

v0.60.4.4

v0.60.4.x

v0.60.5

v0.60.5.1

v0.60.5.2

v0.60.5.3

v0.60.5.x

v0.60.6

v0.60.6.1

v0.60.6.2

v0.60.6.x

v0.60.x

v0.61.0-beta

v0.61.0.1-beta

v0.61.0.10-beta

v0.61.0.2-beta

v0.61.0.3-beta

v0.61.0.4-beta

v0.61.0.5-beta

v0.61.0.6-beta

v0.61.0.7-beta

v0.61.0.8-beta

v0.61.0.9-beta

v0.61.0.x

v0.61.1

v0.61.1.1

v0.61.1.2

v0.61.1.3

v0.61.1.4

v0.61.1.5

v0.61.1.x

v0.61.x

v0.9-final

v1.*

v1.40.0

v1.40.0-rc2

v1.41.0-RC1

v1.42.0-preview1

v1.42.0-rc2

v1.43.0-rc1

v1.44.0-RC1

v1.45.0-RC1

v1.45.0-RC2

v1.47.0-RC1

v1.48.0-RC1

v1.52.0-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59826.json"