CVE-2026-59826

Name of the Vulnerable Software and Affected Versions Metabase versions 1.55.0 through 1.58.15.0 Metabase versions 1.59.0 through 1.59.11 Metabase versions 1.60.0 through 1.60.6.2 Metabase versions 1.61.0 through 1.61.1

Description Metabase fails to validate unsafe H2 connection properties during a specific database-creation process. This allows an authenticated administrator to register a specially crafted H2 database connection to execute arbitrary Java code on the server.

Recommendations Update to version 1.58.15.1 Update to version 1.59.12 Update to version 1.60.6.3 Update to version 1.61.2