## https://sploitus.com/exploit?id=57023231-372E-54F4-B123-832EAC012E93
# CVE-2026-59827: Metabase Unsafe Deserialization in H2 Native Queries
**Severity:** Critical (CVSS 9.9)
**CVE:** CVE-2026-59827
**Advisory:** [GHSA-w95f-x9v9-wv36](https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36)
**Reporter:** Matheus Gutierre (@Gutierre0x80)
**Published:** June 30, 2026
## Vulnerability Summary
An authenticated user with access to native SQL queries on an H2 database can execute arbitrary Java code on the Metabase server via unsafe deserialization of Java objects returned from `SELECT CAST(X'...' AS OTHER)` queries.
The default Metabase installation includes an H2 sample database, making this vulnerability exploitable on all default deployments.
### Affected Versions
- Metabase >= 1.58.0, = 1.59.0, = 1.60.0, = 1.61.0,
```
The script validates that `clojure-1.12.3.jar` and `VarChainPayload.class` exist in the working directory before execution.
---
## Usage
```bash
python3 exploit.py
```
### Arguments
| Argument | Description | Example |
|---|---|---|
| `target_url` | Metabase instance URL | `http://127.0.0.1:3000` |
| `username` | Authenticated user (admin or with native query access) | `admin@example.com` |
| `password` | User password | `SecurePassword123!` |
| `command` | Shell command to execute | `id` or `whoami` |
### Example
```bash
python3 exploit.py http://127.0.0.1:3000 admin@admin.com Admin1234! "id > /tmp/pwned.txt"
```
The command is executed in the context of the Metabase process (typically the `metabase` user in Docker).
---
### Technical Details
The H2 `OTHER` column type deserializes Java objects using a bare `ObjectInputStream` without JEP-290 filtering. This allows arbitrary class instantiation.
The payload uses a gadget chain based on Clojure's serializable classes (`clojure.core$apply`, `clojure.lang.Var$Serialized`, and `PersistentList`) combined with Java's `PriorityQueue` to trigger code execution via `clojure.core/eval`.
See `writeup/analysis.md` for full technical analysis.
---
## References
- Official Advisory: https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36
- CVE Details: https://vulners.com/cve/CVE-2026-59827