# CVE-2026-59827: Metabase Unsafe Deserialization in H2 Native Queries

**Severity:** Critical (CVSS 9.9)

**CVE:** CVE-2026-59827

**Advisory:** [GHSA-w95f-x9v9-wv36](https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36)

**Reporter:** Matheus Gutierre (@Gutierre0x80)

**Published:** June 30, 2026

## Vulnerability Summary

An authenticated user with access to native SQL queries on an H2 database can execute arbitrary Java code on the Metabase server via unsafe deserialization of Java objects returned from `SELECT CAST(X'...' AS OTHER)` queries.

The default Metabase installation includes an H2 sample database, making this vulnerability exploitable on all default deployments.

### Affected Versions

- Metabase >= 1.58.0, < 1.58.15
- Metabase >= 1.59.0, < 1.59.12
- Metabase >= 1.60.0, < 1.60.6.3
- Metabase >= 1.61.0, < 1.61.1.4

### Patched Versions

- Metabase 1.58.15
- Metabase 1.59.12
- Metabase 1.60.6.3
- Metabase 1.61.1.4

---

## Installation

### Prerequisites

- Python 3.7+
- requests library: `pip install requests`
- Java (OpenJDK 11+)
- JAR file must be in the same directory as `exploit.py`:
- clojure-1.12.3.jar (required for payload generation)

### Setup

Ensure all prerequisites are installed and available in PATH:

```bash
# Install Python requests library
pip install requests

# Verify Java is available (OpenJDK 11+)
java -version

# Verify Python 3.7+
python3 --version
```

Then run the exploit from the `poc/` directory:

```bash
cd poc/
python3 exploit.py <target_url> <username> <password> <command>
```

The script validates that `clojure-1.12.3.jar` and `VarChainPayload.class` exist in the working directory before execution.

---

## Usage

```bash
python3 exploit.py <target_url> <username> <password> <command>
```

### Arguments

| Argument | Description | Example |
|---|---|---|
| `target_url` | Metabase instance URL | `http://127.0.0.1:3000` |
| `username` | Authenticated user (admin or with native query access) | `admin@example.com` |
| `password` | User password | `SecurePassword123!` |
| `command` | Shell command to execute | `id` or `whoami` |

### Example

```bash
python3 exploit.py http://127.0.0.1:3000 admin@admin.com Admin1234! "id > /tmp/pwned.txt"
```

The command is executed in the context of the Metabase process (typically the `metabase` user in Docker).

---

### Technical Details

The H2 `OTHER` column type deserializes Java objects using a bare `ObjectInputStream` without JEP-290 filtering. This allows arbitrary class instantiation.

The payload uses a gadget chain based on Clojure's serializable classes (`clojure.core$apply`, `clojure.lang.Var$Serialized`, and `PersistentList`) combined with Java's `PriorityQueue` to trigger code execution via `clojure.core/eval`.

See `writeup/analysis.md` for full technical analysis.

---

## References

- Official Advisory: https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36
- CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59827