Metabase (0.58.0 - 0.58.14, 0.59.0 - 0.59.11, 0.60.0 - 0.60.6.2, 0.61.0 - 0.61.1.3)

Metabase instances configured with H2 databases are vulnerable to authenticated remote code execution via insecure Java deserialization triggered through native SQL queries, identified as CVE-2026-59827.