9.1

CVE-2026-59826

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Metabase ≫ Metabase SwEditionenterprise Version >= 1.55.0 < 1.58.15.1
Metabase ≫ Metabase SwEditionenterprise Version >= 1.59.0 < 1.59.12
Metabase ≫ Metabase SwEditionenterprise Version >= 1.60.0 < 1.60.6.3
Metabase ≫ Metabase SwEditionenterprise Version >= 1.61.0 < 1.61.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.429
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35
Vendor Advisory
https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01
Patch
https://github.com/metabase/metabase/releases/tag/v0.58.15.1
Product
https://github.com/metabase/metabase/releases/tag/v0.59.12
Product
Release Notes
https://github.com/metabase/metabase/releases/tag/v0.60.6.3
Product
https://github.com/metabase/metabase/releases/tag/v0.61.2
Product
Release Notes