CVE-2026-103928: Metabase H2 Database RCE Vulnerability

CVE-2026-103928 Overview

Metabase is an open source business intelligence and analytics platform. CVE-2026-103928 affects Metabase versions from 1.55.0 through 1.58.15, 1.59.12, 1.60.8, and 1.61.3. Native queries and actions executed against an H2 data source are passed through without restricting host-facing built-in functions. Any user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server, or link additional databases. The default sample database uses H2, so the vulnerable surface is exposed by default. The flaw is tracked as [CWE-73: External Control of File Name or Path].

Critical Impact
Authenticated attackers with native query privileges can read or write arbitrary files on the Metabase server and pivot to connected data sources through unrestricted H2 built-in functions.

Affected Products

Metabase 1.55.0 through 1.58.15
Metabase 1.59.0 through 1.59.12
Metabase 1.60.0 through 1.60.8 and 1.61.0 through 1.61.3

Discovery Timeline

2026-10-13 - CVE-2026-103928 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-103928

Vulnerability Analysis

Metabase forwards native SQL submitted against H2 data sources directly to the H2 engine without filtering host-facing functions. H2 ships with built-in routines that interact with the host operating system and arbitrary network resources. These include FILE_READ and FILE_WRITE for raw file I/O, CSVREAD and CSVWRITE for structured file access, and LINK_SCHEMA for linking external databases into the current session. Because the default Metabase sample database is backed by H2, every fresh install exposes this surface unless the sample database is removed.

The vulnerability allows a user who holds the native query or action privilege to escape the intended analytics boundary. Reading /etc/passwd, application configuration files, or metabase.db secrets becomes a single query. Writing files enables web shell drop, cron injection, or tampering with Metabase configuration. LINK_SCHEMA further lets the attacker attach unauthorized databases and query them through the same session.

Root Cause

The root cause is missing allow-listing of H2 functions inside the Metabase H2 driver. The driver executed arbitrary SQL text without inspecting the parsed command tree for host-facing calls. Patched builds introduce parser-level checks in src/metabase/driver/h2.clj that recognize unsupported functions and reject them with explicit error messages before execution.

Attack Vector

Exploitation requires an authenticated account with permission to run native queries or actions against an H2 data source. The attacker submits a native SQL statement invoking one of the host-facing functions. No user interaction and no additional privileges beyond native query rights are required.

text

// Patch excerpt - src/metabase/driver/h2.clj
    [metabase.util.i18n :refer [deferred-tru tru]]
    [metabase.util.log :as log]
    [metabase.util.malli :as mu]
-   [metabase.util.performance :refer [every? some]])
+   [metabase.util.performance :as perf :refer [every? some]])
   (:import
    (java.sql Clob Connection ResultSet ResultSetMetaData SQLException Statement Types)
    (java.time OffsetTime)
    (org.h2.command CommandInterface Parser)
-   (org.h2.engine SessionLocal)))
+   (org.h2.engine SessionLocal)
+   (org.h2.util StringUtils)))

Source: Metabase Commit a943448e

Detection Methods for CVE-2026-103928

Indicators of Compromise

Native query audit log entries containing FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA targeting an H2 data source.
Unexpected files created in the Metabase working directory or user home, such as scripts, JAR files, or new web content.
Outbound JDBC connections initiated by the Metabase process to hosts not configured as data sources.
Access to the local metabase.db.mv.db file or application configuration files from within native queries.

Detection Strategies

Enable Metabase query audit logging and alert on native queries that reference host-facing H2 functions by name.
Monitor the Metabase process for file writes outside its expected working set and for new child processes.
Correlate authentication events for native-query-capable accounts with sudden volume spikes in H2 queries.

Monitoring Recommendations

Forward Metabase application logs and host process telemetry to a central analytics store for retrospective hunting.
Baseline normal H2 query patterns per user and alert on deviations such as queries that return filesystem paths.
Review which accounts hold the native query privilege and track changes to those grants.

How to Mitigate CVE-2026-103928

Immediate Actions Required

Upgrade to Metabase 1.58.16, 1.59.13, 1.60.9, or 1.61.4 as appropriate for your release train.
Remove the default H2 sample database from production instances if it is not required.
Audit which users hold the native query and action permissions on H2 data sources and revoke where unnecessary.
Rotate any credentials, API tokens, or encryption keys readable from the Metabase host filesystem.

Patch Information

Metabase published fixed releases that enforce an allow-list on H2 functions and reject host-facing calls. See Metabase Release v0.58.15.3, Metabase Release v0.59.12.1, Metabase Release v0.60.8.1, and Metabase Release v0.61.3.4. Full remediation detail is published in GitHub Security Advisory GHSA-cwxq-fmxq-jv8h.

Workarounds

Migrate analytics workloads off H2 to a server-class database such as PostgreSQL or MySQL and remove H2 data source entries.
Restrict native query and action permissions to a small set of trusted administrators until patches are applied.
Run the Metabase process under a least-privileged service account with no read access to sensitive host files or secrets.

bash

# Verify installed Metabase version and plan upgrade
java -jar metabase.jar version

# Example: remove the default H2 sample database connection via API
curl -X DELETE \
  -H "X-Metabase-Session: $SESSION" \
  https://metabase.example.com/api/database/<sample-db-id>