Metabase: PoC Exploit Released for Critical Metabase Enterprise RCE Vulnerability

Critical RCE Vulnerability in Metabase Enterprise Exploited in the Wild

Security researchers have disclosed a severe remote code execution (RCE) vulnerability in Metabase Enterprise, tracked as CVE-2026-33725, after a proof-of-concept (PoC) exploit was publicly released. The flaw, stemming from an H2 JDBC INIT injection weakness during serialization imports, allows unauthenticated attackers to execute arbitrary code or access sensitive files on vulnerable systems.

The vulnerability affects multiple Metabase Enterprise versions, including:

• 1.47.0–1.54.21
• 1.55.0–1.55.21
• 1.56.0–1.56.21
• 1.57.0–1.57.15
• 1.58.0–1.58.9
• 1.59.0–1.59.3

A Python-based PoC exploit, published by Hakai Security researcher Diego Tellaroli, automates the attack chain, increasing the risk of widespread exploitation. While the tool includes an educational disclaimer, its availability lowers the barrier for threat actors to launch automated attacks against exposed instances.

Metabase has released patched versions (1.59.4, 1.58.10, 1.57.16) to mitigate the flaw. Organizations unable to patch immediately are advised to restrict access to the Metabase admin interface, limit network exposure, and monitor logs for suspicious activity. Unpatched systems risk full compromise, data breaches, and potential lateral movement within enterprise networks.

Source: https://cyberpress.org/poc-exploit-released-for-critical-metabase-enterprise-rce-vulnerability/

Metabase TPRM report: https://www.rankiteo.com/company/metabase

"id": "met1777286018",
"linkid": "metabase",
"type": "Vulnerability",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology/Business Intelligence',
                        'name': 'Metabase Enterprise users',
                        'type': 'Software/Enterprise'}],
 'attack_vector': 'Unauthenticated exploitation via H2 JDBC INIT injection '
                  'during serialization imports',
 'data_breach': {'sensitivity_of_data': 'High (potential for full system '
                                        'compromise)',
                 'type_of_data_compromised': 'Sensitive files, arbitrary code '
                                             'execution'},
 'description': 'Security researchers have disclosed a severe remote code '
                'execution (RCE) vulnerability in Metabase Enterprise, tracked '
                'as CVE-2026-33725, after a proof-of-concept (PoC) exploit was '
                'publicly released. The flaw, stemming from an H2 JDBC INIT '
                'injection weakness during serialization imports, allows '
                'unauthenticated attackers to execute arbitrary code or access '
                'sensitive files on vulnerable systems. A Python-based PoC '
                'exploit, published by Hakai Security researcher Diego '
                'Tellaroli, automates the attack chain, increasing the risk of '
                'widespread exploitation.',
 'impact': {'data_compromised': 'Sensitive files, arbitrary code execution',
            'operational_impact': 'Full system compromise, potential lateral '
                                  'movement within enterprise networks',
            'systems_affected': 'Metabase Enterprise instances (versions '
                                '1.47.0–1.54.21, 1.55.0–1.55.21, '
                                '1.56.0–1.56.21, 1.57.0–1.57.15, '
                                '1.58.0–1.58.9, 1.59.0–1.59.3)'},
 'post_incident_analysis': {'corrective_actions': 'Patch vulnerable versions, '
                                                  'restrict admin interface '
                                                  'access, enhance monitoring',
                            'root_causes': 'H2 JDBC INIT injection weakness '
                                           'during serialization imports'},
 'recommendations': 'Apply patched versions (1.59.4, 1.58.10, 1.57.16), '
                    'restrict access to Metabase admin interface, limit '
                    'network exposure, and monitor logs for suspicious '
                    'activity.',
 'references': [{'source': 'Hakai Security (Diego Tellaroli)'}],
 'response': {'containment_measures': 'Restrict access to Metabase admin '
                                      'interface, limit network exposure, '
                                      'monitor logs for suspicious activity',
              'enhanced_monitoring': 'Monitor logs for suspicious activity',
              'remediation_measures': 'Apply patched versions (1.59.4, '
                                      '1.58.10, 1.57.16)'},
 'title': 'Critical RCE Vulnerability in Metabase Enterprise Exploited in the '
          'Wild',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-33725'}