Vulnerabilidades de H2oai
CVEs publicadas que afetam produtos de H2oai: 5 registro(s), com severidade, exploração e correções.
CVE-2026-8752
Média · 5.3
CWE-266 17/05/2026
h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control
A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-8751
Crítica · 9.8
CWE-20 17/05/2026
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-8750
Alta · 7.5
CWE-200 17/05/2026
h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure
A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-3960
Crítica · 9.8
CWE-94 23/04/2026
Remote Code Execution in h2oai/h2o-3
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.
CVE-2024-5986
Crítica · 9.1
CWE-73 02/02/2026
Escrita Arbitrária de Arquivos no h2o-3 pelos Endpoints de Parse e Exportação
Uma vulnerabilidade no h2oai/h2o-3 versão 3.46.0.1 permite que atacantes remotos gravem dados arbitrários em qualquer arquivo do servidor. Isso é alcançado explorando o endpoint /3/Parse para injetar dados controlados pelo atacante como cabeçalho de um arquivo vazio, que é então exportado usando o endpoint /3/Frames/framename/export. O impacto desta vulnerabilidade inclui o potencial para execução remota de código e acesso completo ao sistema que executa o h2o-3, já que atacantes podem sobrescrever arquivos críticos, como chaves SSH privadas ou arquivos de script.