Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*

2 briefs RSS
high advisory

Authenticated Remote Code Execution in Metabase via H2 Deserialization

Metabase instances configured with H2 databases are vulnerable to authenticated remote code execution via insecure Java deserialization triggered through native SQL queries, identified as CVE-2026-59827.

Metabase
1r 2t 1c
critical advisory

Critical Pre-Authentication RCE in Metabase (CVE-2023-38646)

A critical pre-authentication Remote Code Execution vulnerability in Metabase allows unauthenticated attackers to execute arbitrary system commands via malicious H2 database connection strings.

Metabase
1r 2t 1c