A critical deserialization vulnerability in Metabase allows authenticated users to execute arbitrary code on the server when connected to an H2 database.

The vulnerability exists in the handling of H2 native query results. The application deserializes arbitrary Java objects returned in columns of type OTHER without validation, enabling an authenticated attacker with native query privileges to achieve code execution.

Successful exploitation allows an attacker to bypass application-level controls and execute code directly on the Metabase host. This poses a severe risk of data breach, as the attacker could access the underlying database, credentials, or other system assets. The CVSS score of 9.9 highlights the extreme severity of this flaw, particularly for organizations using Metabase for business intelligence.

Immediate Action: Update Metabase to versions 1.58.15, 1.59.12, 1.60.6.3, 1.61.1.4, or later immediately.

Proactive Monitoring: Audit database query logs for suspicious activity, particularly queries involving native H2 calls or unexpected usage of the OTHER data type.

Compensating Controls: Restrict access to the Metabase interface and limit the ability of users to run native database queries to only trusted administrative accounts until patches are applied.

Public Exploit Available: No

Given the critical CVSS score and the potential for complete system takeover, applying the vendor-provided patches is the only effective mitigation. Security teams should prioritize patching instances that are exposed to untrusted users or that utilize H2 databases.