Remote Code Execution Vulnerability in H2O-3 Produced by H2O.ai

CVE-2026-3960

What is CVE-2026-3960?

A remote code execution vulnerability has been identified in H2O-3, specifically in the unauthenticated REST API endpoint /99/ImportSQLTable. This flaw arises from inadequate security controls in the parameter blacklist mechanism, which aims to filter out dangerous parameters specific to the MySQL JDBC driver. However, attackers can exploit this weakness by switching the JDBC URL protocol to jdbc:postgresql: to manipulate PostgreSQL JDBC driver-specific parameters, such as socketFactory and socketFactoryArg. As a result, this allows unauthenticated attackers to execute arbitrary code on the H2O-3 server, operating with the same privileges as the H2O-3 process. This issue has been addressed in version 3.46.0.10.

References