CVE-2026-33725: 
NixOS vulnerability analysis and mitigation

CVE-2026-33725 is a deserialization/H2 JDBC INIT injection vulnerability in Metabase Enterprise that allows authenticated administrators to achieve Remote Code Execution (RCE) and Arbitrary File Read via the POST /api/ee/serialization/import endpoint. It affects all Metabase Enterprise versions with serialization support (dating back to at least v1.47) up to and including versions prior to 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4. Metabase OSS is not affected. The vulnerability was published on March 27, 2026, with patches released around the same date. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Feedly).

The root cause is improper handling of untrusted deserialized data (CWE-502) submitted to the serialization import endpoint. An attacker crafts a malicious serialization archive (YAML-based) that injects an INIT property into the H2 JDBC connection spec; when Metabase performs a database sync, the injected SQL is executed by the H2 engine. For RCE, the attack is two-stage: first, a Clojure payload is written to disk via the injected SQL, then it is executed to achieve OS command execution. For Arbitrary File Read, crafted YAML causes the JVM process to exfiltrate any readable file via an HTTP callback during sync. Exploitation requires admin-level authentication but no user interaction, and was confirmed to work on Metabase Cloud (GitHub Advisory).

Successful exploitation grants an attacker full Remote Code Execution on the Metabase server and the ability to read any file accessible to the JVM process, resulting in complete compromise of confidentiality, integrity, and availability. An attacker could exfiltrate sensitive business intelligence data, credentials, or configuration files, and use the compromised server as a pivot point for lateral movement within the network. The impact was confirmed on Metabase Cloud deployments, extending the risk beyond self-hosted instances (GitHub Advisory, Feedly).

A public proof-of-concept exploit was published on GitHub (repository: ASkyeye/CVE-2026-33725) approximately one month after initial disclosure, prompting security media coverage warning of imminent mass exploitation (GBHackers, CyberPress). Emerging Threats released detection rules for this vulnerability on April 29, 2026 (Emerging Threats). The EPSS score is approximately 0.347%, and there is no confirmed evidence of active in-the-wild exploitation or CISA KEV listing as of the available data (Feedly). The vulnerability was discovered and responsibly disclosed by Hacktron AI and Rahul Maini (GitHub Advisory).

1. Reconnaissance: Identify Metabase Enterprise instances (self-hosted or cloud) using internet scanning tools (e.g., Shodan, Censys) or internal network enumeration. Confirm the version is below the patched releases (1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, or 1.59.4).
2. Obtain admin credentials: Authenticate to the Metabase instance using valid admin credentials (obtained via phishing, credential stuffing, or insider access).
3. Craft malicious serialization archive: Create a YAML-based serialization archive that injects an INIT property into the H2 JDBC database spec. For RCE, embed a Clojure payload that writes a script to disk. For Arbitrary File Read, embed a callback URL to receive exfiltrated file contents during sync.
4. Submit the archive: Send a POST request to /api/ee/serialization/import with the crafted archive as the payload, using the authenticated admin session token.
5. Trigger database sync: The Metabase server processes the import and performs a database sync, during which the injected INIT SQL is executed by the H2 engine.
6. Achieve RCE or file read: For RCE, trigger execution of the written Clojure payload to obtain OS command execution. For file read, collect the exfiltrated file contents from the attacker-controlled HTTP callback server (GitHub Advisory, GBHackers).

• Network: Unexpected outbound HTTP requests from the Metabase server to unknown external hosts (potential file exfiltration callbacks during database sync); unusual POST requests to /api/ee/serialization/import from non-standard admin IP addresses.
• Logs: Metabase application logs showing import operations by admin accounts at unusual times; H2 database logs reflecting unexpected SQL execution (especially INIT-related statements) during sync events; access logs with large or unusual multipart POST bodies to the serialization import endpoint.
• File System: Unexpected Clojure script files or JAR artifacts written to the Metabase working directory or temp directories; new or modified files in directories writable by the JVM process.
• Process: Unusual child processes spawned by the Metabase JVM (e.g., shell commands, curl, wget, or scripting interpreters); unexpected network connections initiated by the Java process (GitHub Advisory, Emerging Threats).

Metabase has released patched versions: 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4. Administrators should upgrade to the appropriate patched version immediately using the official Docker images (e.g., metabase/metabase-enterprise:v1.59.4.x) or JAR downloads from the Metabase downloads page. As a temporary workaround if immediate patching is not possible, disable the serialization import endpoint (/api/ee/serialization/import) and restrict admin access to trusted users only (GitHub Advisory).

Security media outlets including GBHackers, CyberPress, and IT Security News covered the public PoC release in late April 2026, warning organizations to patch before mass exploitation begins (GBHackers, CyberPress). Emerging Threats added detection rules to their ruleset on April 29, 2026, reflecting community urgency (Emerging Threats). The Rankiteo blog and UnderCode Testing also published technical analyses and video walkthroughs of the exploit (Rankiteo, UnderCode Testing).