CVE-2026-3960: H2O-3 Code Injection Vulnerability in ai.h2o:h2o-core
Summary
CVE-2026-3960: H2O-3 is Vulnerable to Code Injection. Affects ai.h2o:h2o-core versions < 3.46.0.10. Fixed in 3.46.0.10. How to fix ↓
Also tracked for
- h2o · PyPI
The same CVE-2026-3960 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2O-3 is an open-source machine learning platform that provides a suite of algorithms for data analysis and predictive modeling. It is designed to be user-friendly and scalable, allowing users to build and deploy machine learning models efficiently. The platform is widely used in various industries for tasks such as data mining, predictive analytics, and big data processing. However, a critical vulnerability has been identified in its unauthenticated REST API endpoint, which could allow unauthorized access and execution of arbitrary code.
Vulnerability Detail
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. This vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process, potentially leading to data breaches and system compromise.
How To Fix
Minimum fixed version
3.46.0.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the vulnerable REST API endpoint by implementing network-level security measures, such as firewalls or IP whitelisting, to prevent unauthorized access until the package is updated.
Conclusion
The H2O-3 platform has a critical vulnerability that allows for remote code execution through its REST API. It is essential for users to update to the patched version 3.46.0.10 to mitigate the risk of exploitation. Implementing additional security measures can also help protect against unauthorized access.
See every vulnerability recorded for ai.h2o:h2o-core →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
H2O-3 versions 3.46.0.9 and prior are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check your application using the Vulert playground without any signup.
If exploited, this vulnerability could allow unauthorized attackers to execute arbitrary code on the H2O-3 server, leading to data breaches and system compromise.
Yes, the vulnerability is resolved in version 3.46.0.10 of H2O-3. It is recommended to update to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for ai.h2o:h2o-core.
