When an attacker with sufficient privileges to execute native SQL queries interacts with an H2 database instance, they can leverage the 'OTHER' data type to pass arbitrary serialized Java objects to the application. Because the application fails to validate these objects, they are deserialized upon retrieval, leading to arbitrary code execution with the permissions of the Metabase process. This vulnerability is particularly dangerous for instances where the sample H2 database remains active and accessible to authenticated users. Defenders should prioritize patching to the versions listed in the vendor advisory.

Attack Chain

1. The attacker authenticates to the target Metabase instance with valid user credentials.
2. The attacker navigates to the query interface and identifies an accessible H2 database connection.
3. The attacker crafts a malicious serialized Java object payload using external tooling.
4. The attacker executes a native SQL query via the Metabase '/api/dataset' endpoint containing the payload cast to the H2 'OTHER' data type.
5. The Metabase application processes the query and retrieves the data from the H2 database.
6. The application performs insecure deserialization of the object returned in the query result column.
7. The Java deserialization process triggers the execution of arbitrary system commands on the underlying server host.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands on the host running the Metabase application. This can lead to complete server compromise, including data exfiltration, lateral movement within the environment, and persistence establishment. The vulnerability affects a broad range of recent Metabase versions across various deployment environments.

Recommendation

Prioritize patching all Metabase installations to versions that address CVE-2026-59827 as documented in the GitHub security advisory GHSA-w95f-x9v9-wv36. If immediate patching is not possible, disable the sample H2 database and restrict 'native query' permissions for all non-administrative users.

Detection Engineering

Deploy monitoring for the following patterns in web server access logs to identify exploitation attempts:

1. Enable web server logging for the '/api/dataset' endpoint to capture POST requests containing SQL queries.
2. Monitor for native SQL queries involving the CAST function directed at H2-type databases that include suspicious hex strings or references to deserialization gadgets.
3. Audit for unauthorized access to the '/api/dataset' endpoint by users without explicit database query permissions.