CVE-2026-33725: Metabase Enterprise RCE Vulnerability

CVE-2026-33725 Overview

CVE-2026-33725 is a critical Remote Code Execution (RCE) vulnerability affecting Metabase Enterprise Edition, an open source business intelligence and embedded analytics tool. Authenticated administrators can exploit the POST /api/ee/serialization/import endpoint to achieve Remote Code Execution and Arbitrary File Read capabilities. The vulnerability stems from improper handling of serialization archives, where a crafted archive can inject an INIT property into the H2 JDBC specification, enabling arbitrary SQL execution during database synchronization operations.

Critical Impact

Authenticated administrators on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read, potentially compromising the entire Metabase deployment including Metabase Cloud environments.

Affected Products

• Metabase Enterprise Edition versions prior to 1.54.22
• Metabase Enterprise Edition versions prior to 1.55.22
• Metabase Enterprise Edition versions prior to 1.56.22
• Metabase Enterprise Edition versions prior to 1.57.16
• Metabase Enterprise Edition versions prior to 1.58.10
• Metabase Enterprise Edition versions prior to 1.59.4
• All Metabase Enterprise versions with serialization feature (dating back to version 1.47)

Discovery Timeline

• 2026-03-27 - CVE-2026-33725 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33725

Vulnerability Analysis

This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The flaw exists in Metabase Enterprise Edition's serialization import functionality, which is designed to allow administrators to import configuration and data between Metabase instances. The vulnerability requires network access and high privileges (administrative authentication), but once those conditions are met, an attacker can achieve full system compromise with high impact to confidentiality, integrity, and availability.

The attack has been confirmed to work on Metabase Cloud environments, significantly expanding the potential attack surface to include cloud-hosted deployments. Importantly, Metabase OSS (Open Source Software) is not affected as it lacks the vulnerable codepaths present in the Enterprise Edition.

Root Cause

The root cause is insecure deserialization in the serialization import endpoint. The application fails to properly sanitize or validate the contents of uploaded serialization archives before processing them. Specifically, the archive can contain malicious payloads that inject an INIT property into the H2 JDBC connection specification. This injected property is then executed as arbitrary SQL during the database synchronization process, bypassing normal security controls.

Attack Vector

The attack requires an authenticated administrator to send a malicious POST request to the /api/ee/serialization/import endpoint with a specially crafted serialization archive. The attack flow proceeds as follows:

1. An attacker with administrative access crafts a malicious serialization archive
2. The archive contains a manipulated database connection specification with an injected INIT property
3. The attacker uploads this archive via the serialization import endpoint
4. During the database sync process, the H2 database engine processes the INIT property
5. The injected SQL commands execute with the privileges of the Metabase application
6. This enables Remote Code Execution and/or Arbitrary File Read operations

The attack leverages the H2 database's INIT connection property, which allows arbitrary SQL statements to be executed when the connection is established. By injecting malicious SQL into this property, attackers can execute system commands or read arbitrary files from the server.

Detection Methods for CVE-2026-33725

Indicators of Compromise

• Unusual POST requests to /api/ee/serialization/import endpoint from unexpected sources
• Modified or newly created database connection configurations containing INIT properties
• Unexpected H2 database initialization sequences in application logs
• Abnormal file system access patterns from the Metabase process
• Outbound network connections from the Metabase server to unknown destinations

Detection Strategies

• Monitor API logs for requests to the /api/ee/serialization/import endpoint and correlate with administrator activity
• Implement file integrity monitoring on Metabase configuration directories and database files
• Deploy network detection rules to identify H2 JDBC injection patterns in serialized data streams
• Establish baseline administrative behavior and alert on deviations in serialization import activity

Monitoring Recommendations

• Enable verbose logging for the serialization import functionality to capture detailed request payloads
• Implement real-time alerting for any access to the vulnerable endpoint outside of scheduled maintenance windows
• Deploy endpoint detection and response (EDR) solutions to monitor the Metabase server process for suspicious child processes or file operations
• Review administrator access logs regularly to identify potentially compromised credentials

How to Mitigate CVE-2026-33725

Immediate Actions Required

• Upgrade Metabase Enterprise Edition to the latest patched version immediately (versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, or 1.59.4 depending on your version branch)
• Audit administrator accounts for any signs of compromise or unauthorized access
• Review recent serialization import operations for any suspicious activity
• If patching is not immediately possible, disable the serialization import endpoint as a temporary workaround

Patch Information

Metabase has released security patches addressing this vulnerability across multiple version branches. Organizations should update to the following patched versions based on their current deployment:

For detailed information about the vulnerability and patch details, refer to the GitHub Security Advisory GHSA-fppj-vcm3-w229.

Workarounds

• Disable the serialization import endpoint in your Metabase instance to prevent access to the vulnerable codepaths
• Implement network-level restrictions to limit access to administrative API endpoints
• Use a web application firewall (WAF) to filter requests to the /api/ee/serialization/import endpoint
• Restrict administrative access to trusted networks and implement multi-factor authentication for all admin accounts

# Configuration example - Restrict access to serialization endpoint via reverse proxy (nginx)
location /api/ee/serialization/import {
    # Deny all access to the vulnerable endpoint until patched
    deny all;
    return 403;
}