Metabase Enterprise CVE-2026-33725: Authenticated Admin RCE via H2 JDBC INIT Injection in Serialization Import, Public PoC Released
A high-severity vulnerability, CVE-2026-33725 (CVSS v3.1 7.2), affects Metabase Enterprise and allows an authenticated administrator to achieve remote command execution. It was discovered by Hacktron AI and Rahul Maini. The flaw lies in the /api/ee/serialization/import route, where the subname field of an imported YAML is concatenated uns…