Critical RCE Vulnerability in Metabase Enterprise: Analyzing the CVE-2026-33725 H2 JDBC Injection Exploit

Security researchers have moved from theoretical discovery to practical demonstration by publishing a working Proof of Concept (PoC) for a critical vulnerability impacting Metabase Enterprise. This flaw, tracked as CVE-2026-33725, represents a high-stakes risk for data-driven organizations, as it facilitates both arbitrary file disclosure and full Remote Code Execution (RCE).

The transition from a private discovery to a publicly available exploit script significantly shifts the threat landscape. For administrators running unpatched instances of this popular business intelligence platform, the window for proactive defense has narrowed considerably.

Technical Analysis: The H2 JDBC INIT Injection

At its core, the vulnerability is rooted in how Metabase Enterprise handles the deserialization of import files. The technical breakdown reveals a sophisticated injection flaw involving the H2 database engine’s INIT command.

To visualize the mechanics: imagine a secure facility that is currently processing a batch of new employee credentials. During this high-activity period, an attacker manages to slip a “master key” command into the credential data. Because the system is busy parsing the incoming data, it inadvertently executes the embedded command as a legitimate instruction.

When the Metabase application processes a maliciously structured import file, it triggers an H2 JDBC connection string containing an INIT command. This command instructs the database engine to execute arbitrary SQL or system-level instructions upon connection. Consequently, an attacker can break out of the application sandbox to read sensitive configuration files from the host server or execute system-level code, granting them total control over the underlying infrastructure.

Affected Metabase Enterprise Versions

Impacted organizations must immediately audit their deployment environments. The vulnerability is present across several specific release branches within the Enterprise Edition. If your version falls within the following ranges, your system is considered vulnerable:

• 1.47.0 through 1.54.21
• 1.55.0 through 1.55.21
• 1.56.0 through 1.56.21
• 1.57.0 through 1.57.15
• 1.58.0 through 1.58.9
• 1.59.0 through 1.59.3

The Public Exploit: Weaponization Risk

The vulnerability has gained renewed urgency following the release of a Python-based exploit script on GitHub by Diego Tellaroli, a researcher at Hakai Security. The repository provides an automated attack chain designed to bypass standard defenses and achieve the CVE-2026-33725 exploit.

While the release is framed within a research and educational context, the “democratization” of such tools means that even low-skilled threat actors can now weaponize this code for automated scanning and exploitation campaigns. Hakai Security and its QuimeraX Intelligence platform typically release these findings to force a faster response from vendors and to provide Threat Intelligence consumers with the data needed to defend their networks.

Remediation and Mitigation Strategies

The most effective defense is a rapid update to a patched version. Because the exploit relies on the specific logic used during the serialization import process, upgrading the software effectively neutralizes the injection vector.

Immediate Action: Update to the following secure releases:

• 1.59.4 or higher
• 1.58.10 or higher
• 1.57.16 or higher

Compensating Controls (If patching is delayed):

If an immediate deployment of a patch is not feasible due to change management constraints, administrators should implement the following “defense-in-depth” measures:

1. Network Segmentation: Restrict access to the Metabase administration panel using strict IP allow-listing or a VPN.
2. Enhanced Logging: Closely monitor application and system logs for unusual activity related to serialization imports or unexpected jdbc connection attempts.
3. WAF Implementation: Deploy Web Application Firewall (WAF) rules to detect and intercept common SQL injection and command injection patterns targeting file upload endpoints.