Skip to content
Threat Feed
Subscribe

Product

Metabase Enterprise

1 brief RSS
high advisory

Metabase Enterprise Remote Code Execution via Serialization Import

Authenticated administrators in vulnerable Metabase Enterprise editions can achieve Remote Code Execution (RCE) and Arbitrary File Read by injecting an `INIT` property into the H2 JDBC spec via a crafted serialization archive through the `POST /api/ee/serialization/import` endpoint.

Metabase Enterprise metabase rce serialization cve-2026-33725
2r 1t