« Volver al listado

CVE-2026-59827

Estado: AnalizadaAlta (8.8)—

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Deserialización Java sin validación en consultas H2 por usuario autenticado (PR:L) en servicio remoto: T1210. Ejecución de código arbitrario (CWE-502) y potencial escalada de privilegios en servidor Metabase.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Metabase — Metabase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-59827",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59827",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-09T18:21:29.850266Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.58.0, < 1.58.15"
            },
            {
              "status": "affected",
              "version": ">= 1.59.0, < 1.59.12"
            },
            {
              "status": "affected",
              "version": ">= 1.60.0, < 1.60.6.3"
            },
            {
              "status": "affected",
              "version": ">= 1.61.0, < 1.61.1.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-09T18:16:57.893",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/commit/00f42511fe3bc4385652a2e96862ee6fd7d42cf8",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/releases/tag/v0.58.15",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/releases/tag/v0.59.12",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/releases/tag/v0.61.1.4",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4."
    }
  ],
  "lastModified": "2026-07-13T14:31:08.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D1C8BEA-BD7B-4C14-9AE1-466B7D019127",
              "versionEndExcluding": "0.58.15",
              "versionStartIncluding": "0.58.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B648AB1A-81FB-4AEF-82C8-8F2BCA09FC16",
              "versionEndExcluding": "0.59.12",
              "versionStartIncluding": "0.59.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1BB121C-3598-4E4B-BA48-9D84A7034646",
              "versionEndExcluding": "0.60.6.3",
              "versionStartIncluding": "0.60.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7019395-3201-4E03-91B0-AA873892BC00",
              "versionEndExcluding": "0.61.1.4",
              "versionStartIncluding": "0.61.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F596AA8F-F71B-424E-A989-EAA400F0AFED",
              "versionEndExcluding": "1.58.15",
              "versionStartIncluding": "1.58.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D4D6812-A12B-4C94-A02D-1E8E4D7CB072",
              "versionEndExcluding": "1.59.12",
              "versionStartIncluding": "1.59.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89B5D9B0-5F4E-4F56-8E50-A97FC4912AAF",
              "versionEndExcluding": "1.60.6.3",
              "versionStartIncluding": "1.60.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0FD7CD8-FA4B-4CD3-9B3E-EE6EA5DBD1B2",
              "versionEndExcluding": "1.61.1.4",
              "versionStartIncluding": "1.61.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}